Phishing Resistant MFA How it Works!

In this session I’ll show you how to enforce and manage Phishing Resistant credentials (MFA) using a series of new features and functionality in Microsoft entra ID. Features that prevent hackers from using traditional phishing tools against your users and organisation. This is session filled with tips and advice that will reduce the risks and increasing your security posture.
For more on me visit me at www.Andymalone.org
Looking for more? Why not sign up to my Patreon page www.patreon.com/Andymalonemvp
Dive Deeper Tech Days event on the 7th May. Only £99 Per seat for a full days training with some awesome sessions and demos. More details here. www.quality-training.co.uk/events
Timecodes
00:00 Introduction
04:00 The problem with passwords
04:42 Introducing Phishing Resistant Credentials
06:19 How do Passkeys work?
07:32 What is the AAGUID?
09:08 Custom Authentication Strengths
10:39 Enforcing Passwordless Authentication in Conditional Access
12:10 Introducing & Managing Passkeys DEMO
14:20 Conclusions

[@ReQuiem_2099]

Could not have come at a more perfect time! 🙌

[@user-mg1ey8nn8j]

Another top quality video. Thank you Andy!

[@shailukov7440]

Perfect explanation. Thank you for being who you are!

[@1.618Golden]

Great info, Imma have to watch this a few more times to get all that info in my thick skull. Thank you sir Andy!

[@tony6626]

Great presentation Andy, interesting stuff!

[@AndyMaloneMVP]

Many thanks!

[@donefh]

Great content!

[@jreamscape]

dope stuff andy

[@supriyochatterjee4095]

Brilliant information

[@AndyMaloneMVP]

Glad you think so!

[@chaosmassive8627]

Hi Andy, can you make a video on Intune? especially for hybird joined domain PC?, enjoyed your video as always.

[@uuciuao8s8s-lw2ob]

Pretty please??

[@1.618Golden]

Thanks!

[@AndyMaloneMVP]

Thanks so much :-)

[@MyVlogTubes]

Microsoft Entra ID is every minute and day changing, you cant keep up with the changing with new updates!

[@AndyMaloneMVP]

Practice practice :-)

[@1.618Golden]

I feel you on that one, but like sir Andy says, practice practice. IT is the one field you are guaranteed to have to learn for life. It's a passion we get paid to follow!

[@jmanuelng]

Super cool, how to implement for device logon? 😁

[@AndyMaloneMVP]

Coming soon🙂

[@driver288]

So….. when does passkey support come to Microsoft 365? We are a few months behind schedule already

[@AndyMaloneMVP]

I totally agree with you 😊 I asked the very same question just a month ago in Redmond. It’s coming soon was the answer 😉

[@driver288]

@@AndyMaloneMVP I’ve been testing the passwordless experience for windows and saw the option to use a companion device for login. Do you have some insight into how that works? Passwordless experience basically remove the option to log in using passwords. But how does the companion device work and what devices do they refer to?

[@Zachsnotboard]

Have you gotten passkeys on mobile via the MS authentication app to work ?

[@AndyMaloneMVP]

Yes

[@Zachsnotboard]

@@AndyMaloneMVPwhen I go to add a security key, I only see usb or nfc device 😢

[@alanjrobertson]

Does this deal with the weakness around session cookies being stolen that has been an issue recently?

[@AndyMaloneMVP]

This is no longer an issue as you can fix this issue by using conditional access. I covered this recently in my security video.

[@alanjrobertson]

@@AndyMaloneMVP ah OK, that's good to hear!

[@RamonOchoaMusic]

When is Entra going to completely remove a user’s password like a consumer can currently with an outlook/hotmail account? Currently password- less still lets someone keep clicking on a signin more options until they can get a prompt for password. Password less really isn’t that at this time.

[@AndyMaloneMVP]

Coming soon

[@mattsnider5704]

Thanks for your videos. The audio sounds a bit muffled.

[@AndyMaloneMVP]

I recorded this one on a hotel, my apologies

[@AbdoulsDiallo]

Hi as microsoft partnaire did you know the way to contact Microsoft when all your Microsoft Business Premium account are said doesn't exist. We are facing this issue since Friday but until now can't get in touch with the appropriate support to help us solve the issue. Thanks

[@AndyMaloneMVP]

I feel for you. Support can be a nightmare. Keep trying though they will come back to you.

[@AbdoulsDiallo]

@@AndyMaloneMVP Okay thanks

[@andrewenglish3810]

And how does this work with people who are using AD on-premise?

[@AndyMaloneMVP]

It does not yet. See upcoming Windows 2025

[@tepatrilee3009]

This solution is inherently a cloud based solution using Entra. It has no relevance to AD on-premise. The underlying thought process is that AD on-premise is generally used on an internal network protected by a firewall. 365 authentication goes out over the public internet which has much more inherent risk, and Microsoft is developing authentication protection like phishing resistant MFA to encourage people to trust 365. You can use phishing resistant MFA on premise, like Windows Hello for Business, and others using 3rd party solutions. But this is a Microsoft Entra/cloud specific video.

[@tdavis8517]

We are so tired of our users clicking phishing links, entering their 365 passwords when prompted and getting their MFA token stolen from their browsers. We thought MFA would solve compromised mailboxes but bad actors always find a way...

[@AndyMaloneMVP]

If I may be so bold as to suggest some user training. Incorporate this into your security awareness program. Microsoft also has an excellent attack simulator that you can use.

[@jreamscape]

entra cant ever stay still lol