- [Instructor] So in a previous video in this course,
we looked at how to deploy Multi-Factor Authentication.
That mechanism to ensure a greater level of security
when your users authenticate to access their infrastructure
require them to use multiple methods.
Multiple factors of authentication.
So now let's see how that multiple factors of authentication
actually plays out to when a user needs to authenticate
and access resources.
So what I'm gonna do is create a brand new user
in my Azure Active Directory environment.
And I'm in my Azure portal right now.
I'm gonna create a new user.
I'm gonna call this user, ATest.
And that will be atest@netlogon.com.
And you'll see soon why I call it ATest.
And then I can specify a profile, properties, groups,
make him a member of groups, give him some permissions,
these are all pretty basic user setting configurations.
And then I've got a password over here.
Now what I'm gonna do is I'm going to
click here to copy the password,
so that the password is cached in my clipboard.
And I'm gonna create the user, ATest.
So I'm just gonna run a search to find ATest
in my organization, and here the user is.
I'm going to click on ATest,
so that I can see the configurations of the user.
And the first thing I'm gonna do here
is go to the profile tab.
And I just wanna show you something
that is going to have an impact a little bit later on.
As I go down the list below,
I see here a authentication contact information.
Now this is the contact information that will be used
for that multiple or that second factor of authentication.
So, as an administrator, I can either pre-populate this
or I can allow the user to answer the questions themselves,
and to configure it initially, in terms of providing
their internet method of authentication.
So what I'm gonna do now is go back to my all users.
And click on Multi-Factor Authentication
in order to open up the Multi-Factor Authentication portal
for this user.
So I'm gonna sign in with my administrator user account.
As an administrator, I'm gonna be able to manage
the Multi-Factor Authentication settings.
And now the Multi-Factor Authentication portal
has opened up.
And I see ATest.
And now you'll see why I called him ATest,
so that I can find him easily in the first page.
I click on ATest and then click Enable
to enable Multi-Factor Authentication for the user.
It asks me to validate that I really wanna do this,
and I really do.
So I'm gonna now click close.
And I know that this user has been enabled
for Multi-Factor Authentication.
Now to validate that and actually
to force him to authenticate, I'm actually gonna have him
authenticate to office365.com.
And when I go to office365.com, I'm gonna click on Sign in.
And it's asking me for an email address.
I'm gonna provide the email address
that I specified for the user,
it's actually his user login name.
And then I click on Next.
The next question is for his password.
His password was cached in my clipboard,
so I'm just going to paste it into the field
and click on Sign in.
Now you'll notice that the first thing
that it tells me right here is that
there is an additional step of verification that is required
and it's asking me to set it up now.
So I'm gonna do that.
I am now this user, ATest, and I'm gonna force
this authentication mechanism to ask me
for that second factor of authentication.
But, first, I need to provide some information.
So the first thing that I can do is I can select
what that second factor of authentication will be.
Will it be an authentication phone, an office phone,
or a mobile app?
So there are things called authenticator apps.
And this app is available for the iOS
and android operating system, that you can download.
And you can use that app
as that second method of authentication.
Or you can have an authentication phone,
where you can receive a phone call or a text message
on your authenticating phone.
And, based on the response of that message,
you will then validate the factor the second authentication.
So I'm gonna put in my phone number.
And then I have the choice.
Do I want this to be a text message,
so a code that is sent by text message, or a call.
So I'm gonna do a call, so I get to demonstrate
what that looks like.
And I'm gonna click on Next.
And now the system, the Microsoft authentication system,
is calling my phone.
So my phone rings, I'm gonna answer that.
- [Woman's voice] Thank you for using
Microsoft's sign in verification system.
Please press the pound key to finish your verification.
If you do not initiate this verification. (phone beeps)
- [Instructor] And since this was a legitimate attempt,
I did this myself. - [Woman's Voice] Your sign in
was successfully verified, goodbye.
- [Instructor] And my authentication
has been successfully verified and I see that both,
with the interface and through the phone.
And now it tells me, well, if you're ready
to use this mechanism further,
in order to access various applications
that are accessing Office 365 or Azure,
you can actually use this app password.
And it gives me the ability to copy this app password
into the clipboard.
I don't need to do that right now,
so I'm just going to click on Done.
And it asks me to update my password.
I'm going to now update my password
by pasting the old password and putting in a new password.
Since it was the first time
that I logged in with that temporary password,
I've used the same password too many times,
Azure is recognizing that, so it's forcing me
to use a different password, which I'm going to do.
And now I'm going to click on Sign in.
And it's asking me to validate that sign in again.
And now I'm into my Office 365,
and I've successfully signed into my environment.
Now I wanna show you what happened in the background
when I provided that information.
That authentication information.
Is if I click on my user profile for ATest
and I go down below
to my authentication contact information,
you'll see that a phone number has been populated in here.
And this is the authenticating phone number.
Now if you actually want to provide
an additional phone number,
maybe the user doesn't always have the ability
to use this phone and you wanna give them a second option
of an additional phone that can be used
to authenticate them, you can add an additional
phone number over here, add an email address, as well,
that can be used as an alternate method of authentication.
So Multi-Factor Authentication can be set by the user,
if you require the user to use Multi-Factor Authentication.
Or, as an administrator, you can populate the fields
that define how that user will be contacted
for a second factor of authentication.