You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Multi-factor authentication (MFA) is a great way to secure your organization, but users get frustrated with the additional layer on top of having to remember their passwords. Passwordless authentication methods are more convenient because the password is removed and replaced with something you have plus something you are or something you know.
20
+
Multi-factor authentication (MFA) is a great way to secure your organization, but users often get frustrated with the additional security layer on top of having to remember their passwords. Passwordless authentication methods are more convenient because the password is removed and replaced with something you have, plus something you are or something you know.
21
21
22
22
|| Something you have | Something you are or know |
23
23
| --- | --- | --- |
@@ -33,23 +33,23 @@ Each organization has different needs when it comes to authentication. Microsoft
33
33
34
34
## Windows Hello for Business
35
35
36
-
Windows Hello for Business is ideal for information workers who have their own designated Windows PC. The biometric and PIN are directly tied to the user's PC, which prevents access from anyone other than the owner. With PKI integration and built-in support for single sign-on (SSO), Windows Hello for Business provides a simple and convenient method for seamlessly accessing corporate resources on-premises and in the cloud.
36
+
Windows Hello for Business is ideal for information workers who have their own designated Windows PC. The biometric and PIN are directly tied to the user's PC, which prevents access from anyone other than the owner. With public key infrastructure (PKI) integration and built-in support for single sign-on (SSO), Windows Hello for Business provides a convenient method for seamlessly accessing corporate resources on-premises and in the cloud.
37
37
38
38
The Windows Hello for Business [planning guide](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-planning-guide) can be used to help you make decisions on the type of Windows Hello for Business deployment and the options you'll need to consider.
39
39
40
40
## Microsoft Authenticator App
41
41
42
-
Allow your employee’s phone to become a passwordless authentication method. You may already be using the Microsoft Authenticator App as a convenient multi-factor authentication option in addition to a password. But now, it’s available as a passwordless option.
42
+
Allow your employee's phone to become a passwordless authentication method. You may already be using the Microsoft Authenticator App as a convenient multi-factor authentication option in addition to a password. You can also use the Authenticator App as a passwordless option.
43
43
44
44
45
45
46
-
It turns any iOS or Android phone into a strong, passwordless credential by allowing users to sign in to any platform or browser by getting a notification to their phone, matching a number displayed on the screen to the one on their phone and then using their biometric (touch or face) or PIN to confirm.
46
+
The Authenticator App turns any iOS or Android phone into a strong, passwordless credential. Users can sign in to any platform or browser by getting a notification to their phone, matching a number displayed on the screen to the one on their phone, and then using their biometric (touch or face) or PIN to confirm.
47
47
48
48
## FIDO2 security keys
49
49
50
-
FIDO2 security keys are an unphishable standards-based passwordless authentication method that can come in any form factor. Fast Identity Online (FIDO) is an open standard for passwordless authentication. It allows users and organizations to leverage the standard to sign in to their resources without a username or password using an external security key or a platform key built into a device.
50
+
FIDO2 security keys are an unphishable standards-based passwordless authentication method that can come in any form factor. Fast Identity Online (FIDO) is an open standard for passwordless authentication. FIDO allows users and organizations to leverage the standard to sign in to their resources without a username or password using an external security key or a platform key built into a device.
51
51
52
-
For public preview, employees can use security keys to sign in to their Azure ADjoined Windows 10 devices and get single-sign on to their cloud and on-premises resources. They can also sign in to supported browsers.
52
+
For public preview, employees can use security keys to sign in to their Azure AD-joined Windows 10 devices and get single-sign on to their cloud and on-premises resources. Users can also sign in to supported browsers. FIDO2 security keys are a great option for enterprises who are very security sensitive or have scenarios or employees who aren't willing or able to use their phone as a second factor.
53
53
54
54
55
55
@@ -64,7 +64,7 @@ A security key **MUST** implement the following features and extensions from the
64
64
| 3 | hmac-secret | This extension ensures you can sign in to your device when it's off-line or in airplane mode. |
65
65
| 4 | Multiple accounts per RP | This feature ensures you can use the same security key across multiple services like Microsoft Account and Azure Active Directory. |
66
66
67
-
The following providers offer FIDO2 security keys of different form factors that are known to be compatible with the passwordless experience. Microsoft encourages customers to evaluate the security properties of these keys by contacting the vendor as well as FIDO Alliance.
67
+
The following providers offer FIDO2 security keys of different form factors that are known to be compatible with the passwordless experience. We encourage you to evaluate the security properties of these keys by contacting the vendor as well as FIDO Alliance.
68
68
69
69
| Provider | Contact |
70
70
| --- | --- |
@@ -76,20 +76,18 @@ The following providers offer FIDO2 security keys of different form factors that
> If you purchase and plan to use NFCbased security keys you will need a supported NFC reader.
79
+
> If you purchase and plan to use NFC-based security keys, you need a supported NFC reader for the security key. The NFC reader isn't an Azure requirement or limitation. Check with the vendor for your NFC-based security key for a list of supported NFC readers.
FIDO2 security keys are a great option for enterprises who are very security sensitive or have scenarios or employees who aren’t willing or able to use their phone as a second factor.
81
+
If you're a vendor and want to get your device on this list of supported devices, contact [[email protected]](mailto:[email protected]).
84
82
85
83
## What scenarios work with the preview?
86
84
87
85
- Administrators can enable passwordless authentication methods for their tenant
88
86
- Administrators can target all users or select users/groups within their tenant for each method
89
87
- End users can register and manage these passwordless authentication methods in their account portal
90
88
- End users can sign in with these passwordless authentication methods
91
-
- Microsoft Authenticator App: Will work in scenarios where Azure AD authentication is used, including across all browsers, during Windows 10 Out Of Box (OOBE) setup, and with integrated mobile apps on any operating system.
92
-
- Security keys: Will work on lock screen for Windows 10 and the web in supported browsers like Microsoft Edge.
89
+
- Microsoft Authenticator App: Works in scenarios where Azure AD authentication is used, including across all browsers, during Windows 10 Out Of Box (OOBE) setup, and with integrated mobile apps on any operating system.
90
+
- Security keys: Work on lock screen for Windows 10 and the web in supported browsers like Microsoft Edge.
3. Select **Multi-Factor Authentication**. You may need to scroll to the right to see this menu option. Select the example screenshot below to see the full Azure portal window and menu location:
64
+
[![](media/howto-mfa-userstates/selectmfa-cropped.png"Select Multi-Factor Authentication from the Users window in Azure AD")](media/howto-mfa-userstates/selectmfa.png#lightbox)
65
65
4. A new page that displays the user states opens.
66
66
Copy file name to clipboardExpand all lines: articles/active-directory/develop/reference-breaking-changes.md
+15-2Lines changed: 15 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,7 +14,7 @@ ms.workload: identity
14
14
ms.tgt_pltfrm: na
15
15
ms.devlang: na
16
16
ms.topic: conceptual
17
-
ms.date: 08/28/2019
17
+
ms.date: 1/24/2020
18
18
ms.author: ryanwi
19
19
ms.reviewer: hirsin
20
20
ms.custom: aaddev
@@ -36,7 +36,20 @@ The authentication system alters and adds features on an ongoing basis to improv
36
36
37
37
## Upcoming changes
38
38
39
-
September 2019: Additional enforcement of POST semantics according to URL parsing rules - duplicate parameters will trigger an error and [BOM](https://www.w3.org/International/questions/qa-byte-order-mark) ignored.
39
+
None scheduled at this time. Please see below for the changes that are in or are coming to production.
40
+
41
+
## February 2020:
42
+
43
+
### Empty fragments will be appended to every HTTP redirect from the login endpoint.
44
+
45
+
**Effective date**: February 8, 2020
46
+
47
+
**Endpoints impacted**: Both v1.0 and v2.0
48
+
49
+
**Protocol impacted**: OAuth and OIDC flows that use response_type=query - this covers the [authorization code flow](v2-oauth2-auth-code-flow.md) in some cases, and the [implicit flow](v2-oauth2-implicit-grant-flow.md).
50
+
51
+
When an authentication response is sent from login.microsoftonline.com to an application via HTTP redirect, the service will append an empty fragment to the reply URL. This prevents a class of redirect attacks by ensuring that the browser wipes out any existing fragment in the authentication request. No apps should have a dependency on this behavior.
Copy file name to clipboardExpand all lines: articles/active-directory/hybrid/reference-connect-version-history.md
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -80,6 +80,8 @@ This version fixes a bug where some servers that were auto-upgraded from a previ
80
80
81
81
Under certain circumstances, servers that were auto upgraded to version 1.4.18.0 did not re-enable Self-service password reset and Password Writeback after the upgrade was completed. This auto upgrade release fixes that issue and re-enables Self-service password reset and Password Writeback.
82
82
83
+
We fixed a bug in the sync errors compression utility that was not handling surrogate characters correctly.
0 commit comments