Azure AD Authentication Methods and Policies

In this video, you will learn about Azure AD Authentication Methods and the policies that control the methods. Microsoft has resonantly added to the available Authentication Method Policies. The plan is to depreciate the legacy MFA and Self-Service-Password-Reset (SSPR) policies in 2024. Before they are retired, you need to migrate your legacy configuration.

Watch the video to understand legacy policies, the new policies and the migration process. You can also see all the authentication methods in action and how they are configured by administrators and users.

SUBSCRIBE and KEEP LEARNING
Please add comments, and let's build a community of Identity Geeks together

Join me for an intense 5-day masterclass on Azure AD Identity

Times Codes:
00:00 Into
10:36 The Demo Environment
12:04 FIDO2 Security Keys
17:14 Microsoft Authenticator
25:15 SMS for MFA and SSPR
27:31 SMS for 1st Factor Sign-in
31:03 Using a Temporary Access Pass (TAP)
33:26 Third-party Software OATH Tokens
36:40 Voice Call
38:26 Email OTP for SSPR
42:45 Email OTP for Guest Users
46:54 Certificate-based Authentication
51:07 Adding OATH Hardware tokens & Security Questions
58:06 Administrator Policy
59:27 Wrap up!

[joneslt]

These videos are great! Very clear concise explanations. I am learning alot from your vids. Thank so much!

[palash]

Very impressive and detailed explanation about Azure AD Authentication method :)

[systechadmin]

Very Clear to understand and appreciate your effort to make this video .

[roelofsee]

This is really great John, thanks a lot. They are almost no courses, video's that offer an explanation and demo on this detail (implementation) level.

[qwerty]

This is very clear explanation. Thank you for creating this informative video.

[zameerhussain]

Have been waiting for this awesome thing to happen. Finally 🎉 John’s youtube channel.

[adeo]

Very clear concise information, appreciate it!

[scott]

Clear and engaging. Thanks John, looking forward to your content! By the way, you can create sections in your videos to represent the different topics you've illustrated in the description. All the best!

[munnik]

Hi John, Thank you for this crystal clear insight into Authentication methods.
My question is this: How to migrate legacy MFA/authentication methods to the new Entra/Azure AD Authentication method policies for multiple tenants at once?
Thanks for your insights in advance!

[varunkamarapu]

Hi @john, this is a great video. I thoroughly enjoyed this. Can you please let me know if you are planning to do videos for beginners on AAD, where you will have a video on each blade (such as conditional policies, SSPR, Enterprise apps etc., ) in AAD.

[AndriiKorol-umow]

Thank you for the interesting video.
Maybe you know, how I can handle the MFA via Postman?

[Doctair]

@john, Great Vid! What do you suggest you do for removing the Legacy Per User MFA? Should you go to each user and Disable them and then go to settings tab and uncheck the Methods Available under Verification Options. Perhaps a quick Follow up video of how to remove the old legacy and go all in would be super helpful. Also adding a scenario for Breakglass where they don't have a Yubikey or SMS available. thanks again, so glad I found your channel, Cheers!

[bartoszm]

Great content! Thanks John.
I have a question on the topic of this case.
What if there are Legacy MFA methods set up in the organization?
Let's give an example.
In legacy MFA we have methods enabled: SMS and App.
We want the users in the MFA-App group to be able to register only the App method. What do we need to do in this situation?
Disable all Legacy MFA settings and configure the policy in Azure AD ? Or just a policy that ignores Legacy settings (if it works like that) is enough ?

[pingpingyu]

Hi John, thanks for the great work!! Does the Authentication Method normally work in conjunction with Conditional Access Policies? What are the relationship between this two? What if a user is in a CA policY that requires MFA but not in any Authentication Methods? Thanks Ping

[prabhattanwar]

Hi John,
Thanks for the information. You explained the things really well. I seem to be hung up at a spot where I have my client on Azure Free license (no Azure Premium) and SSP is disabled. I have security defaults enabled for them but it ofcourse prompts them to authenticate logon only when Microsoft thinks its right but I want them to get prompted on attempts to all Office Products just like legacy per user MFA did. I see every article shows Azure premium is in place. I have my client migration status in progress and seem to be stuck in migrating them to complete.
Could you suggest how I would be able to migrate them from legacy MFA to Azure in such case?