Anyone have any experience with using two factor authentication for Office 365?
In 2015 when first trying this it was advised global admins don’t use it and now Microsoft has changed it stance on this and recommending using secure long password that doesn’t expire and enabling 2FA.
I have given it several tries but found that iOS and Android apps for Office 365 either regularly sign out which is a pain as you have to keep signing back into them all and create new passcodes or use MS Authenticator which is desperately unreliable producing nothing more than a blank screen.
Also seems to totally screw up desktop applications on Windows unless you totally uninstall Office apps.
Anyone done this successfully?
7 Spice ups
I’ve been using it for my account for at least a year without any problem. I only use the desktop and online apps (no android or ios apps) so I can’t say how it affects the mobile device apps. I’ve had no problems with the Microsoft authenticator.
pbrain
(Juanoflo)
3
I don’t like the fact that you need separate app passwords. I would really like it if you could enable 2FA only for web and non domain joined computers.
1 Spice up
I use MFA with strong passwords that do expire for admin accounts. Use the SMS verification and it works great.
Yes make sure you store that app password some where safe lol. It’s not fun when you need it, again.
1 Spice up
dreid007
(Don007)
6
Don’t save the password. Delete it and generate a new one.
dreid007
(Don007)
7
I’m with Steve, it just works.
As for bypass for Domain Joined computers, we segment our outbound traffic (LAN gets one public IP, WiFi another, Guest WiFi a third, etc.) and whitelist the LAN’s public IP.
tobywells
(toby wells)
8
We are rolling out and seems to just work, a couple of strange errors enabling it for certain users but other than that its working well
Whitelist LAN’s public IP to bypass MFA? Why would you make any effort to bypass MFA?
dreid007
(Don007)
10
Given that we are in a locked environment with a short idle screen lock time and a long passphrase, we evaluated the risk and determined that machines physically attached to our internal network met the MFA criteria of “something you have” couple that with the passphrase “something you know” and you have MFA.
Jono
(Jono)
11
Just be bear in mind when enabling MFA that powershell or EWS apps that use the admin accounts may fail
The MS Outlook APP has been fine and MFA with users on the internal network using APP token also works well…
Ensure your AD and Cloud passwords have been reset and are in sync
I have tested in our MSP Office365. Configured MFA for a set of users ( users configured in a OnPremise AD group sync with Azure AD). You can selectively configure MFA for each user also. Here are the settings available while configuring MFA for each user.
