Office 365 Multi-Factor Authentication (MFA) enabled for no reason

Posted by VarmintLP@reddit | sysadmin | View on Reddit | 35 comments

Hey, A few days ago we noticed that there is now a prompt to setup the MFA each time someone logs into their Office 365 tools like Outlook or Teams. Can anyone give me a hand with how to disable this for the organization? I checked under the following links with the following results. * [https://admin.microsoft.com/adminportal/home?Q=m365activeusers#/featureexplorer/security/ConditionalAccess](https://admin.microsoft.com/adminportal/home?Q=m365activeusers#/featureexplorer/security/ConditionalAccess) * Shows information about MFA and a button "Get started" * [https://account.activedirectory.windowsazure.com/UserManagement/MultifactorVerification.aspx](https://account.activedirectory.windowsazure.com/UserManagement/MultifactorVerification.aspx) * Shows a list of our users but "Multi-factor auth status" is disabled for everyone * [https://portal.azure.com/#view/Microsoft\_AAD\_ConditionalAccess/ConditionalAccessBlade/\~/Policies](https://portal.azure.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) * Shows no policies and shows "What is conditional Access?" with some examples and a Get started info. To me it looks like it wasn't setup, yet it still asks for the multi-factor auth setup each time someone logs into their Office 365 mailbox or tries to use Teams. For some users it makes sense to set this up, but some others don't have a company business phone and therefore cannot legally be asked to set it up since it only gives the App option during setup. I'm sure I'm not the only one with this issue. I have tested with my personal phone out of curiosity but nothing changed, on any of the 3 links posted.

Reply to Post

35 Comments

[-]

Old-Communication412@reddit

wow,nice

[-]

Fire597@reddit

Did you manage to get rid of the problem ?

[-]

VarmintLP@reddit (OP)

Not yet. Still working on it but it's slow work. :/

[-]

cerealmadman@reddit

Do as follows: 📷

[-]

AppIdentityGuy@reddit

The app does nothing to their phone and has no access to the data on the phone at all. It’s acting as software token for MFA effectively. When you start talking about MDM that’s a different question. As a few others have pointed out you absolutely want MFA for everyone.

[-]

VarmintLP@reddit (OP)

That's not the issue. It's a legal issue because her in the EU you have the right to disconnect from work. Meaning you can deny to install or do anything on your personal devices that is work related.

[-]

AppIdentityGuy@reddit

Ok. It’s a balancing act because SMS is not a secure enough method for MFA and you absolutely want MFA for all users. There are other technologies out there like FIDO2 keys etc. As regards the disconnect from work thing my Android phone has a work profile that goes totally dead at 6pm. I don’t get any notifications about work email or chat messages etc. With regards to your original issue or question did anyone change anything on your end? If not then this does look like security defaults you can disable these in the Azure AD Portal….

[-]

VarmintLP@reddit (OP)

To be honest I don't see why an SMS is less reliable than the app. Both are installed on a mobile device and if it's stolen or lost or broken, then you cannot access it anymore, except for the SMS where you just move your Sim card to a new phone. But the app was only permitted on this one device. And login into it from a new device doesn't allow you to do so easily and without asking the admin to prompt again for the MFA setup on your next login. About your android thing, that's nice but only works on android. Afaik Apple doesn't give such an option and sadly some of our users use apple in their private lives. On my issue, nobody has touched any setting and it seems as if Microsoft had pushed an update that has enabled it or it was enabled all along but sleeping until recently. I have no other explanation.

[-]

tmontney@reddit

\> I don't see why SMS is less reliable It's not encrypted in transit. If somehow that's not enough... [Hackers access T-Mobile accounts more than 100 times in 2022: Tips to counter SIM-swapping (cryptoslate.com)](https://cryptoslate.com/hackers-access-t-mobile-accounts-more-than-100-times-in-2022-tips-to-counter-sim-swapping/) I'm not able to force users in the U.S. to install apps either on BYOD, nor would I. I forsaw this when forcing MFA, so I ensured we could issue hardware tokens. Sure enough, one flat out refused to install any apps on their phone. Either... * Block BYOD * Issue hardware tokens SMS MFA is certainly better than no MFA, but it's not modern MFA and should not be considered permanent.

[-]

AppIdentityGuy@reddit

It’s not difficult to bribe someone at a network operator to do a sim swap and the swap it back… The app is cryptographically tied to the device so it’s immune to that attack vector

[-]

AppIdentityGuy@reddit

It’s absolutely better than nothing but there are better options.

[-]

VarmintLP@reddit (OP)

True. It's better than nothing and I never claimed it's the most secure thing. But since we are still far away from unlocking things with our brain, I would say a phone call or text message would be good enough for our purposes.

[-]

AppIdentityGuy@reddit

You can I believe change the Authenticator App as the default. I would also take a look at FIDO2 keys such as Yubikeys

[-]

thortgot@reddit

I assure you European companies are using Authenticator on personal phones. Go talk to your colleagues, everyone uses the same solutions. If you are not using MFA in 2023 you are negligent.

[-]

VarmintLP@reddit (OP)

Of course there are European companies doing it with people personal phones, but the users have the right to deny this, meaning the company has to accept this and they cannot force the user to give up their privacy / use their personal device for work related things. It's a right that you have to tell your company that you don't want to use your personal device for work related things. Of course the company may not like this but they cannot retaliate since no law was broken. Anyway, just because some people do it. Doesn't mean that everyone will. Some people take their privacy serious and want to relax without being reminded of work each time they open their phone.

[-]

thortgot@reddit

So have a backup plan of providing physical tokens with rotating RSA keys. This isn't that complicated. Running without MFA in today's threat environment is not reasonable unless your data is worthless.

[-]

GixxeR__@reddit

Do you have security defaults enabled? https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults

[-]

VarmintLP@reddit (OP)

Yes. Should I disable it to get ride of the message? Does it disable something else too or only the MFA?

[-]

Beautyislikeyeah@reddit

Did you do this? Are you still getting the same prompt afterward? Asking because I am in a similar situation, did the above, and am continuing to get the "you have 14 days" prompt to install authenticator. It's only been maybe 20 minutes though and I'm not sure what kind of turnaround to expect before the prompt disappears. Thanks for posting!

[-]

GixxeR__@reddit

Yes, if you don't want to require every user to use MFA, then you'll want to disable it. In addition to requiring all users to use MFA, here are some other features enabling security defaults implements. Requiring administrators to do multifactor authentication. Requiring users to do multifactor authentication when necessary. Blocking legacy authentication protocols. Protecting privileged activities like access to the Azure portal.

[-]

nohairday@reddit

As others have said, it is possible to disable MFA, **but** * if it's a fairly closed system, with limited permissions for users, and good encryption/security methods for anyone working remote - then yeah, consider disabling it for standard users - it's an ease vs security assessment * Do not, for all that is holy, unholy, and just slightly meh, disable MFA for admin users with powerful permissions - the only way I would even consider that is if I sent a very detailed email to the boss listing all the potential issues and risks and got a reply back saying "I don't care about the risks, do it" Disabling MFA for admins is just asking for a breach, and if/when it happens, the damage will be so much worse. And if you think you, as the person who disabled it won't be thrown under the bus without evidence you were really against it and overruled, you are in for a very nasty surprise. I understand the desire for ease of access, but ease of access for the user is also ease of access for someone who manages to get a hold of someone's credentials...

[-]

VarmintLP@reddit (OP)

Of course my boss would throw me under the bus but then again I would ask for confirmation so I cannot lose my job because I was ordered / told to by my boss / the boss of my boss. Obviously I would ask for a written confirmation, even if I send them a mail, Do you approve XYZ? If they say yes, then it's their issue for me.

[-]

Lopsided-Report3474@reddit

Does it only prompt when logging into the web version of Microsoft apps? We have Outlook on the web disabled.

[-]

VarmintLP@reddit (OP)

It appears only when someone tries to use something like Outlook, Excel , Teams, etc. on the web. We cannot disable the Outlook on the web as some of our users exclusively have to use that for their work. I cannot elaborate further on this.

[-]

Icy_Rooster_415@reddit

Did someone enable self service password reset recently? If so, how many methods do they require? That would be why your email being added still prompts you (if for example they required two methods to be registered).

[-]

Icy_Rooster_415@reddit

Also -- I really do feel like there is always a way to enforce MFA. I would really try to make a documented push to try to get it for everyone zero exceptions, other than maybe break the glass or service accounts. Those should be restricted by conditional access to limit where and how they can be used. It is not always free, but you can require phone call verification to desk phones for example. Most users have a phone number I would imagine.

[-]

VarmintLP@reddit (OP)

Yeah most of our users have a company phone. Either fixed or mobile.

[-]

redguy13@reddit

Suggestion. You can actually use powershell and make a script that adds users phones into office 365. If you do this then since it already has a method for MFA then it wont prompt them to install the app. I want to stress how simple this was. You just get a spreadsheet with email accounts, slap a phone number by it then use that as input for the command. Had my whole organization's MFA set up in minutes. We also found we got no pushback since it was just a text message being sent to them and not an app being installed on their phones.

[-]

VarmintLP@reddit (OP)

Counter for the suggestion, I added an option to send a mail to my personal mailbox, for testing purposes. Under view account > Security info and it still asked. Also right now I think I have locked myself out because I uninstalled the app and also removed my entry in the app and well it still keeps asking for this stupid authenticator app. I also doesn't offer me "Sign in another way" so essentially I'm locked out.

[-]

VarmintLP@reddit (OP)

Ok fixed it after browsing around in the Azure AD this morning and was rather well hidden. Anyway I got it back to working. If anyone needs, go to [https://portal.azure.com/#view/Microsoft\_AAD\_IAM/AuthenticationMethodsMenuBlade/\~/AuthMethodsActivity](https://portal.azure.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AuthMethodsActivity) and click on "Users capable of Azure multifactor authentication". Here you can select a user and under Authentication contact info you need to click on "Require re-register multifactor authentication" to prompt the user again to setup the MFA on their next login.

[-]

Fire597@reddit

Hello I do have the same issue but one step earlier. I realised from mail alerts and popups on admin office center that MFA policy will be forced on all users in 10 days. It is said that it is the "security defaults" that'd be enabled and that users will be able to skip MFA setup for another 14 days before locking the account. I already disabled it but was wondering if it will force it in 10 days. Since you are in the future for me, could you tell me if disabling security defaults is possible without enforcing conditionnal access ?

[-]

VarmintLP@reddit (OP)

We have the same kind of time frame. But I noticed that the counter is different depending on who connected when. Some people have 14 days others have 11. It's super weird.

[-]

XKSS_@reddit

Disable security defaults. And please, by the love of god use MFA for every account. It's 2023.

[-]

VarmintLP@reddit (OP)

Isn't that basically what I try to disable? I mean the MFA

[-]

XKSS_@reddit

If you disable security defaults you can make a conditional access policy with your own scope.