You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory-b2c/threat-management.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -55,7 +55,7 @@ The smart lockout feature uses many factors to determine when an account should
55
55
- Passwords such as 12456! and 1234567! (or newAccount1234 and newaccount1234) are so similar that the algorithm interprets them as human error and counts them as a single try.
56
56
- Larger variations in pattern, such as 12456! and ABCD2!, are counted as separate tries.
57
57
58
-
When testing the smart lockout feature, use a distinctive pattern for each password you enter. Consider using password generation web apps, such as `https://password-generator.net/`.
58
+
When testing the smart lockout feature, use a distinctive pattern for each password you enter. Consider using password generation web apps, such as `https://password-gen.com/`.
59
59
60
60
When the smart lockout threshold is reached, you'll see the following message while the account is locked: **Your account is temporarily locked to prevent unauthorized use. Try again later**. The error messages can be [localized](localization-string-ids.md#sign-up-or-sign-in-error-messages).
title: Protecting authentication methods in Azure Active Directory
3
+
description: Learn about authentication features that may be enabled by default in Azure Active Directory
4
+
5
+
services: active-directory
6
+
ms.service: active-directory
7
+
ms.subservice: authentication
8
+
ms.topic: conceptual
9
+
ms.date: 10/19/2022
10
+
11
+
ms.author: justinha
12
+
author: mjsantani
13
+
manager: amycolannino
14
+
15
+
ms.collection: M365-identity-device-management
16
+
17
+
# Customer intent: As an identity administrator, I want to encourage users to understand how default protection can improve our security posture.
18
+
---
19
+
# Protecting authentication methods in Azure Active Directory
20
+
21
+
Azure Active Directory (Azure AD) adds and improves security features to better protect customers against increasing attacks. As new attack vectors become known, Azure AD may respond by enabling protection by default to help customers stay ahead of emerging security threats.
22
+
23
+
For example, in response to increasing MFA fatigue attacks, Microsoft recommended ways for customers to [defend users](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/defend-your-users-from-mfa-fatigue-attacks/ba-p/2365677). One recommendation to prevent users from accidental multifactor authentication (MFA) approvals is to enable [number matching](how-to-mfa-number-match.md). As a result, default behavior for number matching will be explicitly **Enabled** for all Microsoft Authenticator users.
24
+
25
+
There are two ways for protection of a security feature to be enabled by default:
26
+
27
+
- After a security feature is released, customers can use the Azure portal or Graph API to test and roll out the change on their own schedule. To help defend against new attack vectors, Azure AD may enable protection of a security feature by default for all tenants on a certain date, and there won't be an option to disable protection. Microsoft schedules default protection far in advance to give customers time to prepare for the change. Customers can't opt out if Microsoft schedules protection by default.
28
+
- Protection can be **Microsoft managed**, which means Azure AD can enable or disable protection based upon the current landscape of security threats. Customers can choose whether to allow Microsoft to manage the protection. They can change from **Microsoft managed** to explicitly make the protection **Enabled** or **Disabled** at any time.
29
+
30
+
>[!NOTE]
31
+
>Only a critical security feature will have protection enabled by default.
32
+
33
+
## Default protection enabled by Azure AD
34
+
35
+
Number matching is a good example of protection for an authentication method that is currently optional for push notifications in Microsoft Authenticator in all tenants. Customers could choose to enable number matching for push notifications in Microsoft Authenticator for users and groups, or they could leave it disabled. Number matching is already the default behavior for passwordless notifications in Microsoft Authenticator, and users can't opt out.
36
+
37
+
As MFA fatigue attacks rise, number matching becomes more critical to sign-in security. As a result, Microsoft will change the default behavior for push notifications in Microsoft Authenticator.
38
+
39
+
>[!NOTE]
40
+
>Number matching will begin to be enabled for all users of Microsoft Authenticator starting February 27, 2023.
41
+
42
+
<!---Add link to Mayur Blog post here--->
43
+
44
+
## Microsoft managed settings
45
+
46
+
In addition to configuring Authentication methods policy settings to be either **Enabled** or **Disabled**, IT admins can configure some settings in the Authentication methods policy to be **Microsoft managed**. A setting that is configured as **Microsoft managed** allows Azure AD to enable or disable the setting.
47
+
48
+
The option to let Azure AD manage the setting is a convenient way for an organization to allow Microsoft to enable or disable a feature by default. Organizations can more easily improve their security posture by trusting Microsoft to manage when a feature should be enabled by default. By configuring a setting as **Microsoft managed** (named *default* in Graph APIs), IT admins can trust Microsoft to enable a security feature they haven't explicitly disabled.
49
+
50
+
For example, an admin can enable [location and application name](how-to-mfa-number-match.md) in push notifications to give users more context when they approve MFA requests with Microsoft Authenticator. The additional context can also be explicitly disabled, or set as **Microsoft managed**. Today, the **Microsoft managed** configuration for location and application name is **Disabled**, which effectively disables the option for any environment where an admin chooses to let Azure AD manage the setting.
51
+
52
+
As the security threat landscape changes over time, Microsoft may change the **Microsoft managed** configuration for location and application name to **Enabled**. For customers who want to rely upon Microsoft to improve their security posture, setting security features to **Microsoft managed** is an easy way stay ahead of security threats. They can trust Microsoft to determine the best way to configure security settings based on the current threat landscape.
53
+
54
+
The following table lists each setting that can be set to Microsoft managed and whether that setting is enabled or disabled by default.
|[Location in Microsoft Authenticator notifications](how-to-mfa-additional-context.md)| Disabled |
60
+
|[Application name in Microsoft Authenticator notifications](how-to-mfa-additional-context.md)| Disabled |
61
+
62
+
As threat vectors change, Azure AD may announce default protection for a **Microsoft managed** setting in [release notes](../fundamentals/whats-new.md) and on commonly read forums like [Tech Community](https://techcommunity.microsoft.com/).
63
+
64
+
## Next steps
65
+
66
+
[Authentication methods in Azure Active Directory - Microsoft Authenticator](concept-authentication-authenticator-app.md)
# Customer intent: As an identity administrator, I want to encourage users to use the Microsoft Authenticator app in Azure AD to improve and secure user sign-in events.
13
13
---
14
-
# How to use additional context in Microsoft Authenticator notifications (Preview) - Authentication methods policy
14
+
# How to use additional context in Microsoft Authenticator notifications - Authentication methods policy
15
15
16
16
This topic covers how to improve the security of user sign-in by adding the application name and geographic location of the sign-in to Microsoft Authenticator passwordless and push notifications.
17
17
@@ -47,7 +47,7 @@ You can enable and disable application name and geographic location separately.
47
47
Identify your single target group for each of the features. Then use the following API endpoint to change the displayAppInformationRequiredState or displayLocationInformationRequiredState properties under featureSettings to **enabled** and include or exclude the groups you want:
0 commit comments