- [Instructor] Earlier in this course,
we discussed a defense in depth approach.
Essentially a solution that provides layers
to minimize the amount of possible attacks
or possible vulnerabilities that we have
in our environment.
A great method or representation of
that layered solution is multi-factor authentication.
Essentially, ensuring that a user proves his
or hers identity by providing multiple methods
of authentication.
One of those methods of authentication is
of course a username and password
that we're all very familiar with.
But what we're doing is adding a secondary method.
And that secondary method is provided
through a device, an actual physical device,
that we have with us at most times.
Typically if you have been familiar
with multi-factor authentications
that have been available in the last 20 years,
you've seen other types of authentications
that required third-party devices
that had to be shift to a user
and that were usually expensive
and complicated to configure.
Today we have cell phones.
And most of us walk around with a mobile phone every day,
so we are now using mobile phones
as that secondary device to provide
that multi-factor authentication,
that secondary authentication.
So let's take a look at how Azure provides
multi-factor authentication for users
of Azure Active Directory.
So first of all what I'm gonna do is,
I'm gonna go ahead and enter my Office 365 admin portal,
remember that Office 365 uses Azure
in its background to manage all of the user credentials.
So what I'm gonna do is I'm actually going
to go and look at a user.
And this is a user that I've created
in my environment.
Savannah.
Now the Savannah user is just a basic user
that actually is not even enabled for Office 365
because I haven't provided any licenses yet.
And I just want to show you that
from the Office 365 portal,
I have an option here to manage multi-factor authentication.
I'm not gonna go here yet because I'm going
to first go take a look at the licenses
that have been assigned to Savannah.
So here under product licenses,
I'm going to click Edit.
And I see here that there are no licenses
for Azure Active Directory Premium.
Now why this is relevant, so there is a license
for Azure Multi-Factor Authentication,
and this is the license that I want
this user to have.
Now this is actually bundled
with Azure Active Directory Premium,
so I can have the Azure Multi-Factor Authentication license
without the parent Azure Active Directory Premium license,
but I can add both and Azure Active Directory Premium
provides a number of additional functionalities
for your users.
So now that the user has Azure Multi-Factor Authentication
as a product license, I can go ahead
and manage my multi-factor authentication settings.
Before I go and modify those settings,
I want to point out that this user is
not currently enabled for multi-factor authentication.
And I knew this because I did not have
any license assigned to this user.
But I also just created the user,
and during the creation of the user,
we actually have an option
to enable multi-factor authentication.
And I'll show you that in a few minutes.
So let's go ahead first and click
on Manage multi-factor authentication.
Now when I open the multi-factor authentication link,
I'm brought into the multi-factor authentication window
that automatically gives me the option
to enable or disable multi-factor authentication
for all of my users.
As well it provides some additional settings
to configure multi-factor authentication.
So first what I'm gonna do is I'm actually going
to go find my user here,
and the user was named Savannah.
So the Savannah user as you see here is disabled
for multi-factor authentication.
So all I have to do is click on the checkbox,
and click Enable.
And here it's prompting me that if I want
to learn more about multi-factor authentication,
there is a great deployment guide,
which I recommend that you read.
So the Savannah user is now enabled
for multi-factor authentication.
Now if I click again on Savannah here,
I can disable, enforce, or manage user settings.
Now if I click here on Enforce,
after multi-factor authentication is enforced,
the user will need to create app passwords
to use non-browser based applications.
So now what an enforcement requires is the user
to use multi-factor authentication
not only to log in to the Office 365 portal
and to use the browser to access all
of the Office 365 resources, but also
to access any resource by using any application.
So this is a more enhanced version
of multi-factor authentication,
which really requires multi-factor authentication
to be used for all access from this user.
I'm not going to enforce at this point,
I'm just going to go to manage user settings,
which gives me some additional configuration options here.
First, I can require the selected user
to provide contact methods again.
Now the contact methods are the methods
that will be used to send that secondary authentication.
So that's the phone number, the email address
that can be used to provide that PIN
that the user will use in order to provide
that secondary authentication.
Do you want to delete all existing app passwords generated
by the selected users?
So the users are going to generate passwords.
Do you want to delete those after they've been generated?
And this is a way of essentially clearing the cache
of those passwords.
And do you want to restore multi-factor authentication
on all remembered devices?
So if a device has been used
for multi-factor authentication do we want
to restore that multi-factor authentication
that's already been used.
So I can save these settings.
I'm not going to save these settings for this user
because I'm not going to actually use any
of these settings at this point.
What I want to do though is show you the settings
that are applicable to all users
of my entire multi-factor authentication provider.