Microsoft 365 MFA-Conditional Access: 4-days implementation

The goal is to increase security by implementing Azure MFA and Conditional Access solutions available on the Microsoft 365 platform. In addition, a communication campaign will be built to promote and sensitize users on the issue as well as the activation of two-factor verification.

Multi-factor authentication is a process where, when signing in, the user is asked to provide an additional form of authentication, such as entering a code on their mobile phone or scanning their fingerprint.

With Azure AD Multi-Factor Authentication, you can use the following additional forms of verification:

• App Microsoft Authenticator
• Token hardware OATH
• sms
• Voice call

For more granular controls, you can use Conditional Access features to define events or applications that require multi-factor authentication. These policies can allow regular sign-in events when the user is on the corporate network or a registered device but requires other verification factors when the user is remote or on a personal device.

Conditional Access capabilities allow you to control access on cloud or on-premise applications, based on certain conditions defined by the IT department.

You can control access to cloud apps based on the user's network location. The location condition is commonly used to block access from countries or regions where traffic to your organization shouldn't be coming from.

Organizations that have Microsoft Intune can use the information returned by devices to identify devices that meet compliance requirements, such as:

1. Request to unlock a PIN;
2. Request device encryption;
3. Requiring a minimum or maximum version of the operating system;
4. The request for a device is not jailbroken or rooted.

Conditional Access is one of the essential features of the Zero Trust model.

Instead of thinking that everything behind the corporate firewall is secure, the Zero Trust model assumes a breach and verifies every request as if it came from an open network. Regardless of where the request comes from or what resource it accesses, Zero Trust teaches us to never trust and always verify. Before granting access, each request is fully authenticated, authorized, and encrypted. The principles of micro-segmentation and less privileged access are applied to minimize lateral movements. Advanced intelligence and analytics are used to detect and respond to anomalies in real time.