Azure, Active Directory, Authentication, Methods

<p>Authentication methods - Azure Active Directory | Microsoft Docs</p>

<p>As an administrator, choosing authentication methods for Azure Multi-Factor Authentication and self-service password reset (SSPR) it is recommended that you require users to register multiple authentication methods. When an authentication method is not available for a user, they can choose to authenticate with another method.</p>

<p>Administrators can define in policy which authentication methods are available to users of SSPR and MFA. Some authentication methods may not be available to all features. For more information about configuring your policies see the articles <a href="howto-sspr-deployment" data-linktype="relative-path">How to successfully roll out self-service password reset</a> and <a href="howto-mfa-getstarted" data-linktype="relative-path">Planning a cloud-based Azure Multi-Factor Authentication</a></p>

<p>Microsoft highly recommends Administrators enable users to select more than the minimum required number of authentication methods in case they do not have access to one.</p>

<table>

<thead>

<tr>

<th>Authentication MethodUsagePasswordMFA</th>

</tr>

</thead>

<tbody>

<tr>

<td>and SSPRSecurityquestionsSSPROnlyEmailaddressSSPROnlyMicrosoftAuthenticator</td>

</tr>

<tr>

</tr>

<tr>

</tr>

<tr>

<td>appMFAandpublicpreview</td>

<td>for SSPROATHHardwaretokenPublicpreviewfor</td>

</tr>

<tr>

<td>MFA and SSPRSMSMFA</td>

</tr>

<tr>

<td>and SSPRVoicecallMFAand</td>

</tr>

<tr>

<td>SSPRApppasswordsMFAonly</td>

</tr>

<tr>

<td>in certain cases</td>

</tr>

</tbody>

</table>

</div>

<table>

<thead>

<tr>

</tr>

</thead>

<tbody>

<tr>

<td>OATH Hardware tokens for MFA and SSPR and Mobile app notification or Mobile app code as methods for Azure AD self-service password reset are public preview features of Azure Active Directory. For more information about previews, see <a href="https://azure.microsoft.com/support/legal/preview-supplemental-terms/" data-linktype="external">Supplemental Terms of Use for Microsoft Azure Previews</a></td>

</tr>

<tr>

</tr>

</tbody>

</table>

</div>

<h2 id="password">Password</h2>

<p>Your Azure AD password is considered an authentication method. It is the one method that <strong>cannot be disabled</strong>.</p>

<h2 id="security-questions">Security questions</h2>

<p>Security questions are available <strong>only in Azure AD self-service password reset</strong> to non-administrator accounts.</p>

<p>If you use security questions, we recommend using them in conjunction with another method. Security questions can be less secure than other methods because some people might know the answers to another user's questions.</p>

<p>Security questions are stored privately and securely on a user object in the directory and can only be answered by users during registration. There is no way for an administrator to read or modify a user's questions or answers.</p>

</div>

<h3 id="predefined-questions">Predefined questions</h3>

<ul>

<li>In what city did you meet your first spouse/partner?</li>

<li>In what city did your parents meet?</li>

<li>In what city does your nearest sibling live?</li>

<li>In what city was your father born?</li>

<li>In what city was your first job?</li>

<li>In what city was your mother born?</li>

<li>What is the last name of your favorite teacher in high school?</li>

<li>What is the name of a college you applied to but didn't attend?</li>

<li>What is the name of the place in which you held your first wedding reception?</li>

<li>What is your father's middle name?</li>

<li>What is your favorite food?</li>

<li>What is your maternal grandmother's first and last name?</li>

<li>What is your mother's middle name?</li>

<li>What is your oldest sibling's birthday month and year? (e.g. November 1985)</li>

<li>What is your oldest sibling's middle name?</li>

<li>What is your paternal grandfather's first and last name?</li>

<li>What is your youngest sibling's middle name?</li>

<li>What school did you attend for sixth grade?</li>

<li>What was the first and last name of your childhood best friend?</li>

<li>What was the first and last name of your first significant other?</li>

<li>What was the last name of your favorite grade school teacher?</li>

<li>What was the make and model of your first car or motorcycle?</li>

<li>What was the name of the first school you attended?</li>

<li>What was the name of the hospital in which you were born?</li>

<li>What was the name of the street of your first childhood home?</li>

<li>What was the name of your childhood hero?</li>

<li>What was the name of your favorite stuffed animal?</li>

<li>What was the name of your first pet?</li>

<li>What was your childhood nickname?</li>

<li>What was your favorite sport in high school?</li>

<li>What was your first job?</li>

<li>What were the last four digits of your childhood telephone number?</li>

<li>When you were young, what did you want to be when you grew up?</li>

<li>Who is the most famous person you have ever met?</li>

</ul>

<p>All of the predefined security questions are translated and localized into the full set of Office 365 languages based on the user's browser locale.</p>

<h3 id="custom-security-questions">Custom security questions</h3>

<p>Custom security questions are not localized. All custom questions are displayed in the same language as they are entered in the administrative user interface, even if the user's browser locale is different. If you need localized questions, you should use the predefined questions.</p>

<p>The maximum length of a custom security question is 200 characters.</p>

<h3 id="security-question-requirements">Security question requirements</h3>

<ul>

<li>The minimum answer character limit is three characters.</li>

<li>The maximum answer character limit is 40 characters.</li>

<li>Users can't answer the same question more than one time.</li>

<li>Users can't provide the same answer to more than one question.</li>

<li>Any character set can be used to define the questions and the answers, including Unicode characters.</li>

<li>The number of questions defined must be greater than or equal to the number of questions that were required to register.</li>

</ul>

<h2 id="email-address">Email address</h2>

<p>Email address is available <strong>only in Azure AD self-service password reset</strong>.</p>

<p>Microsoft recommends the use of an email account that would not require the user's Azure AD password to access.</p>

<h2 id="microsoft-authenticator-app">Microsoft Authenticator app</h2>

<p>The Microsoft Authenticator app provides an additional level of security to your Azure AD work or school account or your Microsoft account.</p>

<p>The Microsoft Authenticator app is available for <a href="https://go.microsoft.com/fwlink/?linkid=866594" data-linktype="external">Android</a>, <a href="https://go.microsoft.com/fwlink/?linkid=866594" data-linktype="external">iOS</a>, and <a href="https://go.microsoft.com/fwlink/?Linkid=825071" data-linktype="external">Windows Phone</a>.</p>

<p>Users will not have the option to register their mobile app when registering for self-service password reset. Instead, users can register their mobile app at <a href="https://aka.ms/mfasetup" data-linktype="external">https://aka.ms/mfasetup</a> or in the security info registration preview at <a href="https://aka.ms/setupsecurityinfo" data-linktype="external">https://aka.ms/setupsecurityinfo</a>.</p>

</div>

<h3 id="notification-through-mobile-app">Notification through mobile app</h3>

<p>The Microsoft Authenticator app can help prevent unauthorized access to accounts and stop fraudulent transactions by pushing a notification to your smartphone or tablet. Users view the notification, and if it's legitimate, select Verify. Otherwise, they can select Deny.</p>

<p class="alert-title">Warning</p>

<p>For self-service password reset when only one method is required for reset, verification code is the only option available to users <strong>to ensure the highest level of security</strong>.</p>

<p>When two methods are required users will be able to reset using <strong>EITHER</strong> notification <strong>OR</strong> verification code in addition to any other enabled methods.</p>

</div>

<p>If you enable the use of both notification through mobile app and verification code from mobile app, users who register the Microsoft Authenticator app using a notification are able to use both notification and code to verify their identity.</p>

<p>If your organization has staff working in or traveling to China, the <strong>Notification through mobile app</strong> method on <strong>Android devices</strong> does not work in that country. Alternate methods should be made available for those users.</p>

</div>

<h3 id="verification-code-from-mobile-app">Verification code from mobile app</h3>

<p>The Microsoft Authenticator app or other third-party apps can be used as a software token to generate an OATH verification code. After entering your username and password, you enter the code provided by the app into the sign-in screen. The verification code provides a second form of authentication.</p>

<p class="alert-title">Warning</p>

<p>For self-service password reset when only one method is required for reset verification code is the only option available to users <strong>to ensure the highest level of security</strong>.</p>

</div>

<p>Users may have a combination of up to five OATH hardware tokens or authenticator applications such as the Microsoft Authenticator app configured for use at any time.</p>

<h2 id="oath-hardware-tokens-public-preview">OATH hardware tokens (public preview)</h2>

<p>OATH is an open standard that specifies how one-time password (OTP) codes are generated. Azure AD will support the use of OATH-TOTP SHA-1 tokens of the 30-second or 60-second variety. Customers can procure these tokens from the vendor of their choice. Secret keys are limited to 128 characters, which may not be compatible with all tokens.</p>

<p>OATH hardware tokens are being supported as part of a public preview. For more information about previews, see <a href="https://azure.microsoft.com/support/legal/preview-supplemental-terms/" data-linktype="external">Supplemental Terms of Use for Microsoft Azure Previews</a></p>

<p>Once tokens are acquired they must be uploaded in a comma-separated values (CSV) file format including the UPN, serial number, secret key, time interval, manufacturer, and model as the example below shows.</p>

<div id="code-try-0" class="codeHeader" data-bi-name="code-header"><span class="language">csvCopy</span><button class="action" data-bi-name="copy"></button></div>

<pre class="has-inner-focus" tabindex="0"><code class="lang-csv" data-author-content="upn,serial number,secret key,timeinterval,manufacturer,model

Helga@contoso.com,1234567,1234567890abcdef1234567890abcdef,60,Contoso,HardwareKey

">upn,serial number,secret key,timeinterval,manufacturer,model

Helga@contoso.com,1234567,1234567890abcdef1234567890abcdef,60,Contoso,HardwareKey

</code></pre>

<p>Make sure you include the header row in your CSV file as shown above.</p>

</div>

<p>Once properly formatted as a CSV file, an administrator can then sign in to the Azure portal and navigate to <strong>Azure Active Directory</strong>, <strong>MFA Server</strong>, <strong>OATH tokens</strong>, and upload the resulting CSV file.</p>

<p>Depending on the size of the CSV file, it may take a few minutes to process. Click the <strong>Refresh</strong> button to get the current status. If there are any errors in the file, you will have the option to download a CSV file listing any errors for you to resolve.</p>

<p>Once any errors have been addressed, the administrator then can activate each key by clicking <strong>Activate</strong> for the token to be activated and entering the OTP displayed on the token.</p>

<p>Users may have a combination of up to five OATH hardware tokens or authenticator applications such as the Microsoft Authenticator app configured for use at any time.</p>

<h2 id="mobile-phone">Mobile phone</h2>

<p>Two options are available to users with mobile phones.</p>

<p>If users don't want their mobile phone number to be visible in the directory, but they still want to use it for password reset, administrators should not populate it in the directory. Users should populate their <strong>Authentication Phone</strong> attribute via the <a href="https://aka.ms/ssprsetup" data-linktype="external">password reset registration portal</a>. Administrators can see this information in the user's profile, but it's not published elsewhere.</p>

<p>To work properly, phone numbers must be in the format <em>+CountryCode PhoneNumber</em>, for example, +1 4255551234.</p>

<p>There needs to be a space between the country code and the phone number.</p>

<p>Password reset does not support phone extensions. Even in the +1 4255551234X12345 format, extensions are removed before the call is placed.</p>

</div>

<h3 id="text-message">Text message</h3>

<p>An SMS is sent to the mobile phone number containing a verification code. Enter the verification code provided in the sign-in interface to continue.</p>

<h3 id="phone-call">Phone call</h3>

<p>An automated voice call is made to the phone number you provide. Answer the call and press # in the phone keypad to authenticate</p>

<p class="alert-title">Important</p>

<p>Starting in March of 2019 the phone call options will not be available to MFA and SSPR users in free/trial Azure AD tenants. SMS messages are not impacted by this change. Phone call will continue to be available to users in paid Azure AD tenants. This change only impacts free/trial Azure AD tenants.</p>

</div>

<h2 id="office-phone">Office phone</h2>

<p>An automated voice call is made to the phone number you provide. Answer the call and presses # in the phone keypad to authenticate.</p>

<p>To work properly, phone numbers must be in the format <em>+CountryCode PhoneNumber</em>, for example, +1 4255551234.</p>

<p>The office phone attribute is managed by your administrator.</p>

<p class="alert-title">Important</p>

</div>

<p>There needs to be a space between the country code and the phone number.</p>

<p>Password reset does not support phone extensions. Even in the +1 4255551234X12345 format, extensions are removed before the call is placed.</p>

</div>

<h2 id="app-passwords">App Passwords</h2>

<p>Certain non-browser apps do not support multi-factor authentication, if a user has been enabled for multi-factor authentication and attempt to use non-browser apps, they are unable to authenticate. An app password allows users to continue to authenticate</p>

<p>If you enforce Multi-Factor Authentication through Conditional Access policies and not through per-user MFA, you cannot create app passwords. Applications that use Conditional Access policies to control access do not need app passwords.</p>

<p>If your organization is federated for SSO with Azure AD and you are going to be using Azure MFA, then be aware of the following details:</p>

<ul>

<li>The app password is verified by Azure AD and therefore bypasses federation. Federation is only used when setting up app passwords. For federated (SSO) users, passwords are stored in the organizational ID. If the user leaves the company, that info has to flow to organizational ID using DirSync. Account disable/deletion may take up to three hours to sync, which delays disable/deletion of app passwords in Azure AD.</li>

<li>On-premises Client Access Control settings are not honored by App Password.</li>

<li>No on-premises authentication logging/auditing capability is available for app passwords.</li>

<li>Certain advanced architectural designs may require using a combination of organizational username and passwords and app passwords when using two-step verification with clients, depending on where they authenticate. For clients that authenticate against an on-premises infrastructure, you would use an organizational username and password. For clients that authenticate against Azure AD, you would use the app password.</li>

<li>By default, users cannot create app passwords. If you need to allow users to create app passwords, select the <strong>Allow users to create app passwords to sign into non-browser applications option</strong> under service settings.</li>

</ul>

<h2 id="next-steps">Next steps</h2>

<p><a href="quickstart-sspr" data-linktype="relative-path">Enable self service password reset for your organization</a></p>

<p><a href="howto-mfa-getstarted" data-linktype="relative-path">Enable Azure Multi-Factor Authentication for your organization</a></p>

<p><a href="howto-registration-mfa-sspr-combined" data-linktype="relative-path">Enable combined registration in your tenant</a></p>

<p><a href="https://aka.ms/securityinfoguide" data-linktype="external">End-user authentication method configuration documentation</a></p>

</div>

</section>

</div>

Azure, Active Directory, Authentication, Methods

Attachments