{"id":14749,"date":"2020-08-01T07:17:27","date_gmt":"2020-08-01T07:17:27","guid":{"rendered":"https:\/\/www.testpreptraining.com\/tutorial\/?page_id=14749"},"modified":"2022-03-23T10:08:13","modified_gmt":"2022-03-23T10:08:13","slug":"learn-to-configure-azure-multi-factor-authentication-settings","status":"publish","type":"page","link":"https:\/\/www.testpreptraining.ai\/tutorial\/learn-to-configure-azure-multi-factor-authentication-settings\/","title":{"rendered":"Learn to Configure Azure Multi-Factor Authentication settings"},"content":{"rendered":"\n
This tutorial will help you to learn To customize the end-user experience for Azure Multi-Factor Authentication, you can configure options for settings like the account lockout thresholds or fraud alerts and notifications. Some options are in the Azure Active Directory (Azure AD) portal, while others are in the Azure Multi-Factor Authentication portal.<\/p>\n\n\n\n
The following Azure Multi-Factor Authentication settings are available in the Azure portal:<\/p>\n\n\n\n
The account lockout settings enable you to select how many unsuccessful MFA attempts to allow before the account is locked out for a period of time to avoid repeated MFA attempts as part of an attack. When a pin code is supplied for the MFA prompt, the account lockout settings are implemented.<\/p>\n\n\n\n
The following settings are available:<\/p>\n\n\n\n
Number of MFA denials to trigger account lockout<\/li>
Minutes until account lockout counter is reset<\/li>
Minutes until account is automatically unblocked<\/li><\/ul>\n\n\n\n
To configure account lockout settings, complete the following settings:<\/p>\n\n\n\n
Sign in to the Azure portal as an administrator.<\/li>
Browse to Azure Active Directory<\/strong> > Security<\/strong> > MFA<\/strong> > Account lockout<\/strong>.<\/li>
Enter the require values for your environment, then select Save<\/strong>.<\/li><\/ol>\n\n\n\n
To block a user, complete the following steps:<\/p>\n\n\n\n
Browse to Azure Active Directory<\/strong> > Security<\/strong> > MFA<\/strong> > Block\/unblock users<\/strong>.<\/li>
Select Add<\/strong> to block a user.<\/li>
Select the Replication Group<\/strong>, then choose Azure Default<\/em>.Enter the username for the blocked user as username\\@domain.com<\/code>, then provide a comment in the Reason<\/em> field.<\/li>
When ready, select OK<\/strong> to block the user.<\/li><\/ol>\n\n\n\n
Unblock a user<\/strong><\/h3>\n\n\n\n
To unblock a user, complete the following steps:<\/p>\n\n\n\n
Browse to Azure Active Directory<\/strong> > Security<\/strong> > MFA<\/strong> > Block\/unblock users<\/strong>.<\/li>
In the Action<\/em> column next to the desired user, select Unblock<\/strong>.<\/li>
Enter a comment in the Reason for unblocking<\/em> field.<\/li>
When ready, select OK<\/strong> to unblock the user.<\/li><\/ol>\n\n\n\n
Fraud alert<\/strong><\/h3>\n\n\n\n
The fraud alert tool allows users to report unauthorized access to their accounts. Users can report a fraud attempt via the Microsoft Authenticator app or their phone when they receive an unfamiliar and suspicious MFA prompt.<\/p>\n\n\n\n
To enable and configure fraud alerts, complete the following steps:<\/p>\n\n\n\n
Browse to Azure Active Directory<\/strong> > Security<\/strong> > MFA<\/strong> > Fraud alert<\/strong>.<\/li>
Set the Allow users to submit fraud alerts<\/em> setting to On<\/strong>.<\/li>
Configure the Automatically block users who report fraud<\/em> or Code to report fraud during initial greeting<\/em> setting as desired.<\/li>
When ready, select Save<\/strong>.<\/li><\/ol>\n\n\n\n
View fraud reports<\/strong><\/h3>\n\n\n\n
Select\u00a0Azure Active Directory<\/strong>\u00a0>\u00a0Sign-ins<\/strong>\u00a0>\u00a0Authentication Details<\/strong>. The fraud report is now part of the normal Azure AD Sign-ins report, and it will appear as MFA rejected, Fraud Code Entered in the “Result Detail.”<\/p>\n\n\n\n
Notifications<\/strong><\/h3>\n\n\n\n
o configure fraud alert notifications, complete the following settings:<\/p>\n\n\n\n
Browse to Azure Active Directory<\/strong> > Security<\/strong> > Multi-Factor Authentication<\/strong> > Notifications<\/strong>.<\/li>
Enter the email address to add into the next box.<\/li>
To remove an existing email address, select the …<\/strong> option next to the desired email address, then select Delete<\/strong>.<\/li>
When ready, select Save<\/strong>.<\/li><\/ol>\n\n\n\n
OATH tokens<\/strong><\/h3>\n\n\n\n
OATH-TOTP SHA-1 tokens that refresh codes every 30 or 60 seconds are supported by Azure AD. Customers can buy these tokens from whatever seller they like.<\/p>\n\n\n\n
OATH TOTP hardware tokens usually include a secret key, or seed, that is pre-programmed in the token. These keys must be entered into Azure AD as outlined in the steps below. Secret keys are restricted to 128 characters, therefore not all tokens will work with them. The secret key must be encoded in Base32 and can only contain the letters a-z or A-Z and numerals 1-7.<\/p>\n\n\n\n
Phone call settings<\/strong><\/h3>\n\n\n\n
You may customise the user’s experience if they receive phone calls for MFA prompts, such as the caller ID or voice greeting they hear.<\/p>\n\n\n\n
To configure your own caller ID number, complete the following steps:<\/p>\n\n\n\n
Browse to Azure Active Directory<\/strong> > Security<\/strong> > MFA<\/strong> > Phone call settings<\/strong>.<\/li>
Set the MFA caller ID number<\/strong> to the number you wish users to see on their phone. Only US-based numbers are allowed.<\/li>
When ready, select Save<\/strong>.<\/li><\/ol>\n\n\n\n
Set up a custom message<\/strong><\/h3>\n\n\n\n
To use your own custom messages, complete the following steps:<\/p>\n\n\n\n
Browse to Azure Active Directory<\/strong> > Security<\/strong> > MFA<\/strong> > Phone call settings<\/strong>.<\/li>
Select Add greeting<\/strong>.<\/li>
Choose the Type<\/strong> of greeting, such as Greeting (standard)<\/em> or Authentication successful<\/em>.<\/li>
Select the Language<\/strong>, based on the previous section on custom message language behavior.<\/li>
Browse for and select an .mp3<\/em> or .wav<\/em> sound file to upload.<\/li>
When ready, select Add<\/strong>, then Save<\/strong>.<\/li><\/ol>\n\n\n\n
MFA service settings<\/strong><\/h3>\n\n\n\n
In the Azure Multi-Factor Authentication service settings, you may configure app passwords, trusted IPs, verification choices, and remember multi-factor authentication. This is a legacy portal that isn’t part of the Azure Active Directory site.<\/p>\n\n\n\n
Service settings can be accessed from the Azure portal by browsing to Azure Active Directory<\/strong> > Security<\/strong> > MFA<\/strong> > Getting started<\/strong> > Configure<\/strong> > Additional cloud-based MFA settings<\/strong>. A new window or tab opens with additional service settings<\/em> options.<\/p>\n\n\n\n
Trusted IPs<\/strong><\/h3>\n\n\n\n
For users that login in from a certain IP address range, Azure Multi-Factor Authentication’s Trusted IPs functionality skips multi-factor authentication prompts. You may establish trusted IP ranges for your on-premises installations so that no Azure Multi-Factor Authentication prompt appears when users are in one of those locations.<\/p>\n\n\n\n
Enable named locations by using Conditional Access<\/strong><\/h3>\n\n\n\n
You can use Conditional Access rules to define named locations using the following steps:<\/p>\n\n\n\n
In the Azure portal, search for and select Azure Active Directory<\/strong>, then browse to Security<\/strong> > Conditional Access<\/strong> > Named locations<\/strong>.<\/li>
Select New location<\/strong>.<\/li>
Enter a name for the location.<\/li>
Select Mark as trusted location<\/strong>.<\/li>
Enter the IP Range in CIDR notation for your environment, such as 40.77.182.32\/27<\/em>.<\/li>
Select Create<\/strong>.<\/li><\/ol>\n\n\n\n
Enable the Trusted IPs feature by using Conditional Access<\/strong><\/h3>\n\n\n\n
To enable trusted IPs using Conditional Access policies, complete the following steps:<\/p>\n\n\n\n
In the Azure portal, search for and select Azure Active Directory<\/strong>, then browse to Security<\/strong> > Conditional Access<\/strong> > Named locations<\/strong>.<\/li>
Select Configure MFA trusted IPs<\/strong>.<\/li>
On the Service Settings<\/strong> page, under Trusted IPs<\/strong>, choose from any of the following two options:
For requests from federated users originating from my intranet<\/strong>: To choose this option, select the check box. All federated users who sign in from the corporate network bypass two-step verification by using a claim that is issued by AD FS. Ensure that AD FS has a rule to add the intranet claim to the appropriate traffic. If the rule does not exist, create the following rule in AD FS:c:[Type== \"http:\/\/schemas.microsoft.com\/ws\/2012\/01\/insidecorporatenetwork\"] => issue(claim = c);<\/code><\/li>
For requests from a specific range of public IPs<\/strong>: To choose this option, enter the IP addresses in the text box by using CIDR notation.
Also, For IP addresses that are in the range xxx.xxx.xxx.1 through xxx.xxx.xxx.254, use notation like xxx.xxx.xxx.0\/24<\/strong>.<\/li>
Furthermore, For a single IP address, use notation like xxx.xxx.xxx.xxx\/32<\/strong>.<\/li>
Enter up to 50 IP address ranges. Users who sign in from these IP addresses bypass two-step verification.<\/li><\/ul><\/li><\/ul><\/li>
Select Save<\/strong>.<\/li><\/ol>\n\n\n\n
Enable the Trusted IPs feature by using service settings<\/strong><\/h3>\n\n\n\n
If you don’t want to use Conditional Access policies to enable trusted IPs, you can configure the service settings<\/em> for Azure Multi-Factor Authentication using the following steps:<\/p>\n\n\n\n
In the Azure portal, search for and select Azure Active Directory<\/strong>, then choose Users<\/strong>.<\/li>
Under Multi-Factor Authentication, select service settings<\/strong>.<\/li>
On the Service Settings<\/strong> page, manage remember multi-factor authentication<\/strong>, select the Allow users to remember multi-factor authentication on devices they trust<\/strong> option.<\/li>
Set the number of days to allow trusted devices to bypass two-step verification. The default is 14 days.<\/li>
![\"Learn](\"https:\/\/www.testpreptraining.ai\/tutorial\/wp-content\/uploads\/2020\/08\/multi-factor-authentication-settings-portal.png\")
![\"\"](\"https:\/\/www.testpreptraining.ai\/tutorial\/wp-content\/uploads\/2020\/08\/account-lockout-settings.png\")
![\"free](\"https:\/\/www.testpreptraining.ai\/tutorial\/wp-content\/uploads\/2020\/07\/Untitled-design-5.png\")
<\/a><\/figure><\/div>\n\n\n\n