1

Full disclosure MS docs confuse me more than help me and a lot of blogs around MFA seem watered down or too vague. I’m sure many spiceheads have already taken this security step, so I’m kind of look for the short and sweet on the process.

We’re licensed O365 Business Standard and I want to enable MFA. What do I need to know or what should I look out for? We rely on Word, Excel, Outlook, and Teams primarily. We don’t use web apps much, so when I flip the switch what happens? I have 1 user that uses an older version of Office suite - if that matters.

We don’t sync AD with O365 at this time, so things are separate between the services.

4 Spice ups
2

This is pretty straight-forward.

You flip the switch, and either the next time a person logs in or if you have reset all sessions, a pop up comes on their mobile devices or computer and asks them to log in. They put in their username and password and then another box comes up asking how they want MFA to work.

You can use several mobile apps (most orgs I work with just use the MS Authenticator app), that they will need to download and log into. But they open the app, get the code, enter it and they are in.

They can also use SMS to get their code.

There are also options to ‘trust this device for 30 days’ so they don’t have to put in MFA codes every time.

Most people are pretty used to this process as more and more sites are using it as an additional security layer out in the wild.

1 Spice up
3

So like a good admin I learned that our O365 domain was setup pre Modern Authentication enabled by default, so our accounts are only using Basic Auth. After enabling MFA for the admins yesterday we were prompted to re-auth everything EXCEPT the Outlook client. I noticed this morning some login failures in Azure AD and it seems to be some services from the Outlook client because we’re using Basic Auth and were never prompted for the app password MS assigned us.

As I’m reading we need Modern Auth enabled for MFA, so my bad. Reading though if I enable Modern Auth now it should only impact the users with MFA also turned on. What I’m concerned with is forcing everyone to reauth all the MS stuff for Modern Auth and then turning MFA force them to do it again. A lot of folks don’t know their O365 passwords, so it’s a burden on helpdesk to make these changes. I’m just trying to understand what will happen and I don’t see a way to limit Modern Auth to certain users.

1 Spice up
4

Kind of talking to myself here, but incase someone else stumbles on this later.

I enabled Modern Auth for our domain and nothing amazing happened. I forced logout on all of my sessions before Outlook client asked me re-authorize with MFA, but after that all was good. I’m waiting to see how long until my other MFA test subjects are prompted without intervention, but that’s just for my own information. Next step is MFA for everyone…

1 Spice up
5

LOL, you definitely are not just talking to yourself! Glad your testing went well, I think that when you roll this out, there will be the inevitable minor hiccups, but it should go well.

Definitely let us know how it goes!

1 Spice up
6

Hey @networks-jj ​ I’m looking into a migration to O365 for our environment and have been given information stating MFA is included on Business Premium, but NOT included on Business Standard. Obviously, your post here is stating differently. (Maybe @darren-for-cdw ​ might be able to advise too?)

Here’s the MS doc that I’m seeing with a feature comparison - https://docs.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/licensing-microsoft-365-in-smb

I’m assuming you looked into things a lot, so maybe you can confirm this and anything I might need to be on the lookout for to enable MFA on Business Standard? Or is there some other version of MFA that only comes with Business Premium?

Any help would be appreciated.

7

I’ve only setup MFA for our admin team at this time, and for what it’s worth it has been working great for our team.

As I understand it standard MFA is free on all platforms. For conditional access or special features you would need Premium, but like I said originally MS documentation is confusing to me. However, others seems to agree with my take.

@timb

8

MFA without granularity for O365 can become a little onerous for your users, but granularity comes at a cost with Premium pricing.

UserLock 11.0 can help you here. It offers an affordable and granular MFA & SSO solution to secure access to O365 (and other cloud applications), using on-premise Active Directory identities.

sso-userlock.jpg

  • Installed in minutes on a standard Windows Server, it works right alongside Active Directory. Users continue to use their AD identity to access all resources from the corporate network and multiple cloud applications.
  • Supports both SAML 2.0 and OpenID Connect to enable federated authentication of MS365 and other cloud applications. Admins easily configure from the console.
  • Customize the circumstances for MFA (by user, group or OU) to provide secure access without unnecessarily hindering users.

MFA-workstation-connections.png

  • MFA supports authenticator applications and hardware tokens such as YubiKey or Token2.
  • Enable MFA on Windows logins, RDP connections, VPN connections, IIS sessions and access to Office 365 and other cloud applications.
  • SSO and MFA to Office 365 and cloud applications have just been released and can be accessed in BETA. We would love to hear your feedback.

Implementing MFA

Configure Office365 for UserLock SSO

Hope this helps.