- [Instructor] What I want to do is show you the settings
that are applicable to all users
of my entire multi-factor authentication provider.
So the first setting that I have here is,
do you want to allows users to create app passwords?
So are the users allowed to create a separate password
or do they require a PIN every time
that they connect?
We want to give them the option by default
to create passwords or to use the PIN.
I can also provide an exception for users.
The skip multi-factor authentication
basically allows you to not require a
multi-factor authentication from devices
that are connecting maybe from an internal location
inside of your network,
or special segment of your network.
So if you know that all devices
in there are trusted and they are physically secured,
you may want to prevent multi-factor authentication
from being requested on a specific range
of IP addresses.
And here you can specify ranges of IP addresses
that will be skipped or avoided.
Now the most important options or settings here
for multi-factor authentication are the methods
that the users can use.
So there are several methods that can be used
for that multi-factor mechanism.
The first one is a call to phone.
Call to phone essentially means
that the phone of the user will receive a phone call
and on that phone call a voice message will provide the PIN.
That PIN will then have to be entered
by the user to authenticate.
A text message.
So the user will receive a text message
and that text message will include that famous PIN
and that PIN is again my secondary mechanism
that I'm gonna use to log on.
So if I don't have my phone,
I cannot receive a phone call,
I cannot receive the text message,
and therefore I won't be able to have
that PIN, that secondary mechanism.
And that's where the device comes in.
I mentioned earlier that you need
to have that secondary device.
So you have your username and password
and then the device.
Now the device is used as a delivery mechanism
for the PIN.
And it can be done via phone call,
text message, or via a mobile app.
So the mobile app can either receive a code
or notification, either one,
it will be delivered directly inside the app.
I don't like the way that this is provided
in four options.
I would prefer to see three options,
call, text message, and using an app,
but essentially those are the mechanisms
that you can receive your PIN,
that the PIN can be delivered to you.
Now we have here also an option
for our trusted devices if you have devices
that are gonna be trusted, do you need
to constantly re-authenticate
on those devices using MFA, multi-factor authentication
or can that be cached for a certain amount of time
so that you don't have to constantly re-enter
your multi-factor authentication if you've
already logged on from a specific device.
So these are my basic service settings options
for multi-factor authentication,
but there are many more enhanced
multi-factor authentication settings.
And I just clicked on the go to portal option
at the bottom of my multi-factor authentication page,
and from here I am brought back into the Azure portal
where I can actually manage some advanced MFA settings
related to an MFA server.
So if I download the MFA server product,
and install it on a virtual machine
or on premises, I can then manage some
more advanced MFA settings.
And I'll give you an example of some of those.
For example here I have the account lockout settings.
Now here I can specify the number of MFA denials
that will trigger an account lockout.
So how many times the user will put the wrong PIN
or will be unable to authenticate
that will then be blocked.
And then I can see the list of those users
that have been blocked.
And I see here any users that have been blocked
and you see as well that a user will remain blocked
for 90 days from the time that they are blocked.
So actually if I don't do anything
after a user has been blocked,
they will be automatically unblocked after 90 days.
And I can unblock a user directly
from this interface as well.
Now I don't have any blocked users here,
but I will be able to right-click
and unblock the user.
As well, if you want to explicitly block a user,
you can click on the Add button
to block a user temporarily.
As well here I have my caching rules.
Now my caching I specify the number
of consecutive authentications
that do not necessarily require an MFA
or a multi-factor authentication.
So when a user logs on consecutively, multiple times,
after how many authentications will you be required
once again to perform an MFA.
So to specify a PIN, or answer a phone call
or a text message.
How often will they require that MFA authentication?
So I've got some additional reporting options here as well,
such as the fraud alerts,
but an interesting option I want
to point out is the One-time bypass.
Now this is specifically used for a help desk
for example, when a user is blocked
or is unable to connect,
or they're missing their two-step verification,
they're missing their multi-factor authentication
product or tool that they cannot connect,
so we can bypass the MFA requirement temporarily.
And this is a feature that only applies
if you have an MFA server that has been deployed again.
You can download it and install that MFA server product,
and then you can bypass the user.
And so the user even though he
or she doesn't have a cell phone,
they don't have that second method of authentication,
we can prevent them from requiring that,
and again, this is a one-time bypass.
So some additional settings here,
but we've covered the most important settings
for MFA for Azure deployments.