Enable/Disable MFA for Azure AD Users and Disable Security Notification for Your Organization's Accounts - NETSEC


Learning, Sharing, Creating

Cybersecurity Memo

Monday, November 21, 2022

Enable/Disable MFA for Azure AD Users and Disable Security Notification for Your Organization's Accounts

Azure Active Directory (Azure AD) Multi-Factor Authentication helps safeguard access to data and applications, providing another layer of security by using a second form of authentication. Organizations can enable multifactor authentication (MFA) with Conditional Access to make the solution fit their specific needs.

This post is to summarize some key steps to plan and implement an Azure AD Multi-Factor Authentication roll-out.

Azure AD Attack Mitigations

Here are some mitigations:

  • Create attack surface reduction (ASR) rules in Microsoft Intune to protect the LSAAS process.
  • Deploy Microsoft Defender for Endpoint to get automatic alerts if suspicious activities or tools are detected.
  • Enable tamper protection to protect your client’s security settings (such as threat protection and real-time AV). Prevent users from taking actions such as disabling virus and threat protection, cloud-delivered protection, or automatic actions against detected threats; turning off behavior monitoring; or removing security intelligence updates.
  • Create a device compliance policy to require Microsoft Defender Antimalware and Defender Real-time Protection and immediately enforce the compliance check.
  • Require a minimal Machine Risk Score in Device Compliance Policy without a long grace period.
  • Use a unique attribute on the device object that will be updated as soon an endpoint is on- or offboarded. This can be used as a dynamic group filter to build an assignment for device compliance policy to require a machine risk score. Otherwise, the device compliance will fail.
  • Consideration in Privileged Access Device scenarios, such as Secure Admin Workstation (SAW) or Privileged Access Workstation (PAW): Require the device to be under a “clear” machine risk score. If changes in compliance policies are enforced immediately the changes are valid in a 5min timeframe (based on our tests).
  • Actively monitor your endpoints to detect malicious credential theft tools (such as Mimikatz & AADInternals).
  • Run a Microsoft Sentinel playbook to “isolate device” if suspicious activity has been detected.

A list of logged-on users on the affected device can be received by calls to the Microsoft 365 Defender API. This should be executed as part of a Microsoft Sentinel Playbook to initialize SOAR actions when offensive identity theft tools have been detected on the endpoint.


Diagram that shows how Conditional Access works to secure the sign-in process.


Cloud-only identity environment with modern authenticationNo prerequisite tasks
Hybrid identity scenariosDeploy Azure AD Connect and synchronize user identities between the on-premises Active Directory Domain Services (AD DS) and Azure AD.
On-premises legacy applications published for cloud accessDeploy Azure AD Application Proxy

Authentication methodSecurityUsabilityAvailability
Windows Hello for BusinessHighHighHigh
Microsoft Authenticator appHighHighHigh
FIDO2 security keyHighHighHigh
Certificate-based authentication (preview)HighHighHigh
OATH hardware tokens (preview)MediumMediumHigh
OATH software tokensMediumMediumHigh

The following table outlines when an authentication method can be used during a sign-in event:

MethodPrimary authenticationSecondary authentication
Windows Hello for BusinessYesMFA*
Microsoft Authenticator appYesMFA and SSPR
FIDO2 security keyYesMFA
Certificate-based authentication (preview)YesNo
OATH hardware tokens (preview)NoMFA and SSPR
OATH software tokensNoMFA and SSPR
Voice callNoMFA and SSPR

The following additional verification methods can be used in certain scenarios:

  • App passwords - used for old applications that don't support modern authentication and can be configured for per-user Azure AD Multi-Factor Authentication.
  • Security questions - only used for SSPR
  • Email address - only used for SSPR

Plan Conditional Access Policies

To create your own conditional access policies, and target specific conditions like Cloud apps, sign-in risk, and device platforms, you will need Azure AD Premium. 

Azure Active Directory Premium P1

Annual commitment - $92.40 / Licenses / year

Billed monthly - $7.70 / Licenses / month

Azure Active Directory Premium P2: A comprehensive cloud Identity and access management solution with advanced identity protection for all your users and administrators. From ‎$11.50‎ ‎licenses‎/month. 

Azure AD Multi-Factor Authentication is enforced with Conditional Access policies. These policies allow you to prompt users for MFA when needed for security and stay out of users' way when not needed.

For end-to-end guidance on Azure AD Conditional Access deployment, see the Conditional Access deployment plan.

Common use cases to require Azure AD Multi-Factor Authentication include:

Plan User Session Lifetime


Plan User Registration


Per-User MFA vs Conditional Access Based MFA

In your tenant, you can enable MFA on a per-user basis. In this scenario, your users perform MFA each time they sign in, with some exceptions, such as when they sign in from trusted IP addresses or when the remember MFA on trusted devices feature is turned on. 

For Azure AD free tenants without Conditional Access, you can use security defaults to protect users. Users are prompted for MFA as needed, but you can't define your own rules to control the behavior.

More about per-user MFA can be found:
Enabling Per-User MFA:

Select a user, then from right column of quick action to enable it:

If your users do not regularly sign in through the browser, you can send them to this link to register for multi-factor auth: https://aka.ms/MFASetup

Based on your organization supported authentication method, you might get following screen with all available authentication methods:

While enabling MFA is a good practice, converting per-user MFA to MFA based on Conditional Access can reduce the number of times your users are prompted for MFA.

This recommendation shows up if:

  • You have per-user MFA configured for at least 5% of your users.
  • Conditional Access policies are active for more than 1% of your users (indicating familiarity with CA policies).

Convert per-user MFA enabled and enforced users to disabled

If your users were enabled using per-user enabled and enforced Azure AD Multi-Factor Authentication the following PowerShell can assist you in making the conversion to Conditional Access based Azure AD Multi-Factor Authentication.

Run this PowerShell in an ISE window or save as a .PS1 file to run locally. The operation can only be done by using the MSOnline module.

# Connect to tenant

# Sets the MFA requirement state
function Set-MfaState {
    Process {
        Write-Verbose ("Setting MFA state for user '{0}' to '{1}'." -f $ObjectId, $State)
        $Requirements = @()
        if ($State -ne "Disabled") {
            $Requirement =
            $Requirement.RelyingParty = "*"
            $Requirement.State = $State
            $Requirements += $Requirement
        Set-MsolUser -ObjectId $ObjectId -UserPrincipalName $UserPrincipalName `
                     -StrongAuthenticationRequirements $Requirements
# Disable MFA for all users
Get-MsolUser -All | Set-MfaState -State Disabled

Enable Azure AD MFA

Your Azure AD Multi-Factor Authentication rollout plan should include a pilot deployment followed by deployment waves that are within your support capacity. Begin your rollout by applying your Conditional Access policies to a small group of pilot users. After evaluating the effect on the pilot users, process used, and registration behaviors, you can either add more groups to the policy or add more users to the existing groups.

Follow the steps below:

  1. Meet the necessary prerequisites
  2. Configure chosen authentication methods
  3. Configure your Conditional Access policies
  4. Configure session lifetime settings
  5. Configure Azure AD MFA registration policies

Disable "Your organization needs more information to keep your account secure"

Disable following two settings is not best practice. It is only for your test or lab environment which you want to save some time to set your identity properly.  

1. Disable Security Default from Entra ID Properties

2. Disable "Self Service Password Reset"

Disable mandatory Microsoft Authenticator App - Disable Security Default


You first need to disable security defaults then in order to remove the requirement for MFA (specifically MS Authenticator App). Here are the steps:

  1. Go to the Microsoft Entra admin center (https://entra.microsoft.com/) and sign in.

  2. Under Microsoft Entra ID (Azure AD), select Go to Microsoft Entra ID.

  3. Select Properties, scroll down, and then select the Manage security defaults link.

  4. On the right side of the screen, in the Security defaults pane, DISABLE security defaults, by using the drop-down menu to select Disable. Then select Save.

  5. Approve all the necessary warnings. This will allow other MFA options through this link: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods

Here's the link to the official help article. Microsoft tricks you by wording the article as the way to enable it, even though that's already the default. Just follow the same steps to disable.


Operation: Manage Azure AD MFA


Reporting and Monitoring

Azure AD has reports that provide technical and business insights, follow the progress of your deployment and check if your users are successful at sign-in with MFA. Have your business and technical application owners assume ownership of and consume these reports based on your organization's requirements.

You can monitor authentication method registration and usage across your organization using the Authentication Methods Activity dashboard. This helps you understand what methods are being registered and how they're being used.

Sign in report to review MFA events

The Azure AD sign-in reports include authentication details for events when a user is prompted for MFA, and if any Conditional Access policies were in use. You can also use PowerShell for reporting on users registered for Azure AD Multi-Factor Authentication.

NPS extension and AD FS logs for cloud MFA activity are now included in the Sign-in logs, and no longer published to Security > MFA > Activity report.

For more information, and additional Azure AD Multi-Factor Authentication reports, see Review Azure AD Multi-Factor Authentication events.

No comments:

Post a Comment