You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
> Users must have previously registered for Azure AD Multifactor Authentication before triggering the sign-in risk policy.
47
+
> Users must have previously registered for Azure AD multifactor authentication before triggering the sign-in risk policy.
48
48
49
49
## User risk-based Conditional Access policy
50
50
@@ -71,13 +71,13 @@ If you already have Identity Protection risk policies set up, we encourage you t
71
71
72
72
## Azure AD MFA registration policy
73
73
74
-
Identity Protection can help organizations roll out Azure AD Multifactor Authentication (MFA) using a policy requiring registration at sign-in. Enabling this policy is a great way to ensure new users in your organization have registered for MFA on their first day. Multifactor authentication is one of the self-remediation methods for risk events within Identity Protection. Self-remediation allows your users to take action on their own to reduce helpdesk call volume.
74
+
Identity Protection can help organizations roll out Azure AD multifactor authentication (MFA) using a policy requiring registration at sign-in. Enabling this policy is a great way to ensure new users in your organization have registered for MFA on their first day. Multifactor authentication is one of the self-remediation methods for risk events within Identity Protection. Self-remediation allows your users to take action on their own to reduce helpdesk call volume.
75
75
76
-
More information about Azure AD Multifactor Authentication can be found in the article, [How it works: Azure AD Multifactor Authentication](../authentication/concept-mfa-howitworks.md).
76
+
More information about Azure AD multifactor authentication can be found in the article, [How it works: Azure AD multifactor authentication](../authentication/concept-mfa-howitworks.md).
77
77
78
78
## Next steps
79
79
80
80
-[Enable Azure AD self-service password reset](../authentication/howto-sspr-deployment.md)
81
-
-[Enable Azure AD Multifactor Authentication](../authentication/howto-mfa-getstarted.md)
82
-
-[Enable Azure AD Multifactor Authentication registration policy](howto-identity-protection-configure-mfa-policy.md)
81
+
-[Enable Azure AD multifactor authentication](../authentication/howto-mfa-getstarted.md)
82
+
-[Enable Azure AD multifactor authentication registration policy](howto-identity-protection-configure-mfa-policy.md)
83
83
-[Enable sign-in and user risk policies](howto-identity-protection-configure-risk-policies.md)
With Azure Active Directory Identity Protection, you can:
21
21
22
-
* Require users to register for Azure AD Multi-Factor Authentication (MFA)
22
+
* Require users to register for Azure AD multifactor authentication (MFA)
23
23
* Automate remediation of risky sign-ins and compromised users
24
24
25
25
All of the Identity Protection policies have an impact on the sign in experience for users. Allowing users to register for and use tools like Azure AD MFA and self-service password reset can lessen the impact. These tools along with the appropriate policy choices gives users a self-remediation option when they need it.
@@ -34,7 +34,7 @@ Enabling the Identity Protection policy requiring multi-factor authentication re
34
34
35
35

36
36
37
-
1. Complete the guided steps to register for Azure AD Multi-Factor Authentication and complete your sign-in.
37
+
1. Complete the guided steps to register for Azure AD multifactor authentication and complete your sign-in.
Copy file name to clipboardExpand all lines: articles/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy.md
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,20 +15,20 @@ ms.reviewer: sahandle
15
15
16
16
ms.collection: M365-identity-device-management
17
17
---
18
-
# How To: Configure the Azure AD Multifactor Authentication registration policy
18
+
# How To: Configure the Azure AD multifactor authentication registration policy
19
19
20
-
Azure Active Directory (Azure AD) Identity Protection helps you manage the roll-out of Azure AD Multifactor Authentication (MFA) registration by configuring a Conditional Access policy to require MFA registration no matter what modern authentication app you're signing in to.
20
+
Azure Active Directory (Azure AD) Identity Protection helps you manage the roll-out of Azure AD multifactor authentication (MFA) registration by configuring a Conditional Access policy to require MFA registration no matter what modern authentication app you're signing in to.
21
21
22
-
## What is the Azure AD Multifactor Authentication registration policy?
22
+
## What is the Azure AD multifactor authentication registration policy?
23
23
24
-
Azure AD Multifactor Authentication provides a means to verify who you are using more than just a username and password. It provides a second layer of security to user sign-ins. In order for users to be able to respond to MFA prompts, they must first register for Azure AD Multifactor Authentication.
24
+
Azure AD multifactor authentication provides a means to verify who you are using more than just a username and password. It provides a second layer of security to user sign-ins. In order for users to be able to respond to MFA prompts, they must first register for Azure AD multifactor authentication.
25
25
26
-
We recommend that you require Azure AD Multifactor Authentication for user sign-ins because it:
26
+
We recommend that you require Azure AD multifactor authentication for user sign-ins because it:
27
27
28
28
- Delivers strong authentication through a range of verification options.
29
29
- Plays a key role in preparing your organization to self-remediate from risk detections in Identity Protection.
30
30
31
-
For more information on Azure AD Multifactor Authentication, see [What is Azure AD Multifactor Authentication?](../authentication/howto-mfa-getstarted.md)
31
+
For more information on Azure AD multifactor authentication, see [What is Azure AD multifactor authentication?](../authentication/howto-mfa-getstarted.md)
32
32
33
33
## Policy configuration
34
34
@@ -54,4 +54,4 @@ For an overview of the related user experience, see:
54
54
55
55
-[Enable Azure AD self-service password reset](../authentication/howto-sspr-deployment.md)
56
56
57
-
-[Enable Azure AD Multifactor Authentication](../authentication/howto-mfa-getstarted.md)
57
+
-[Enable Azure AD multifactor authentication](../authentication/howto-mfa-getstarted.md)
As we learned in the previous article, [Identity Protection policies](concept-identity-protection-policies.md), there are two types of risk policies in Azure Active Directory (Azure AD) Conditional Access you can set up to automate the response to risks and allow users to self-remediate when risk is detected:
20
+
As we learned in the previous article, [Risk-based access policies](concept-identity-protection-policies.md), there are two types of risk policies in Azure Active Directory (Azure AD) Conditional Access you can set up to automate the response to risks and allow users to self-remediate when risk is detected:
Organizations can choose to block access when risk is detected. Blocking sometimes stops legitimate users from doing what they need to. A better solution is to allow self-remediation using Azure AD Multi-Factor Authentication (MFA) and secure self-service password reset (SSPR).
37
+
Organizations can choose to block access when risk is detected. Blocking sometimes stops legitimate users from doing what they need to. A better solution is to allow self-remediation using Azure AD multifactor authentication (MFA) and secure self-service password reset (SSPR).
38
38
39
39
> [!WARNING]
40
40
> Users must register for Azure AD MFA and SSPR before they face a situation requiring remediation. Users not registered are blocked and require administrator intervention.
@@ -50,7 +50,7 @@ Microsoft recommends the below risk policy configurations to protect your organi
50
50
- Sign-in risk policy
51
51
- Require Azure AD MFA when sign-in risk level is **Medium** or **High**, allowing users to prove it's them by using one of their registered authentication methods, remediating the sign-in risk.
52
52
53
-
Requiring access control when risk level is low will introduce more user interrupts. Choosing to block access rather than allowing self-remediation options, like secure password reset and multi-factor authentication, will impact your users and administrators. Weigh these choices when configuring your policies.
53
+
Requiring access control when risk level is low will introduce more user interrupts. Choosing to block access rather than allowing self-remediation options, like secure password reset and multifactor authentication, will impact your users and administrators. Weigh these choices when configuring your policies.
54
54
55
55
## Exclusions
56
56
@@ -103,7 +103,7 @@ After confirming your settings using [report-only mode](../conditional-access/ho
Copy file name to clipboardExpand all lines: articles/active-directory/identity-protection/howto-identity-protection-remediate-unblock.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -47,7 +47,7 @@ For more information about what happens when confirming compromise, see the sect
47
47
48
48
### Self-remediation with risk policy
49
49
50
-
If you allow users to self-remediate, with Azure AD Multi-Factor Authentication (MFA) and self-service password reset (SSPR) in your risk policies, they can unblock themselves when risk is detected. These detections are then considered closed. Users must have previously registered for Azure AD MFA and SSPR for use when risk is detected.
50
+
If you allow users to self-remediate, with Azure AD multifactor authentication (MFA) and self-service password reset (SSPR) in your risk policies, they can unblock themselves when risk is detected. These detections are then considered closed. Users must have previously registered for Azure AD MFA and SSPR for use when risk is detected.
51
51
52
52
Some detections may not raise risk to the level where a user self-remediation would be required but administrators should still evaluate these detections. Administrators may determine that extra measures are necessary like [blocking access from locations](../conditional-access/howto-conditional-access-policy-location.md) or lowering the acceptable risk in their policies.
Copy file name to clipboardExpand all lines: articles/active-directory/identity-protection/howto-identity-protection-simulate-risk.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -38,7 +38,7 @@ More information about each risk detection can be found in the article, What is
38
38
Completing the following procedure requires you to use:
39
39
40
40
- The [Tor Browser](https://www.torproject.org/projects/torbrowser.html.en) to simulate anonymous IP addresses. You might need to use a virtual machine if your organization restricts using the Tor browser.
41
-
- A test account that isn't yet registered for Azure AD Multi-Factor Authentication.
41
+
- A test account that isn't yet registered for Azure AD multifactor authentication.
42
42
43
43
**To simulate a sign-in from an anonymous IP, perform the following steps**:
44
44
@@ -59,7 +59,7 @@ The procedure below uses a newly created:
59
59
Completing the following procedure requires you to use a user account that has:
60
60
61
61
- At least a 30-day sign-in history.
62
-
- Azure AD Multi-Factor Authentication enabled.
62
+
- Azure AD multifactor authentication enabled.
63
63
64
64
**To simulate a sign-in from an unfamiliar location, perform the following steps**:
0 commit comments