You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: "What's new in Azure Active Directory business-to-customer (B2C)"
3
3
description: "New and updated documentation for the Azure Active Directory business-to-customer (B2C)."
4
-
ms.date: 10/31/2022
4
+
ms.date: 03/01/2023
5
5
ms.service: active-directory
6
6
ms.subservice: B2C
7
7
ms.topic: reference
@@ -15,6 +15,15 @@ manager: CelesteDG
15
15
16
16
Welcome to what's new in Azure Active Directory B2C documentation. This article lists new docs that have been added and those that have had significant updates in the last three months. To learn what's new with the B2C service, see [What's new in Azure Active Directory](../active-directory/fundamentals/whats-new.md) and [Azure AD B2C developer release notes](custom-policy-developer-notes.md)
17
17
18
+
## February 2023
19
+
20
+
### Updated articles
21
+
22
+
-[Azure Active Directory B2C code samples](integrate-with-app-code-samples.md)
-[Set up sign-in for a specific Azure Active Directory organization in Azure Active Directory B2C](identity-provider-azure-ad-single-tenant.md)
25
+
-[Page layout versions](page-layout.md)
26
+
18
27
## January 2023
19
28
20
29
### New articles
@@ -71,128 +80,3 @@ Welcome to what's new in Azure Active Directory B2C documentation. This article
71
80
-[Set up a password reset flow in Azure Active Directory B2C](add-password-reset-policy.md)
72
81
-[What is Azure Active Directory B2C?](overview.md)
73
82
-[Technical and feature overview of Azure Active Directory B2C](technical-overview.md)
74
-
75
-
## November 2022
76
-
77
-
### New articles
78
-
79
-
-[Configure Azure Active Directory B2C with Akamai Enterprise Application Access for SSO and secure hybrid access](partner-akamai-secure-hybrid-access.md)
80
-
81
-
### Updated articles
82
-
83
-
-[Manage your Azure Active Directory B2C tenant](tenant-management-manage-administrator.md)
84
-
-[Manage Azure AD B2C with Microsoft Graph](microsoft-graph-operations.md)
85
-
-[Tutorial: Create an Azure Active Directory B2C tenant](tutorial-create-tenant.md)
86
-
-[Roles and resource access control](roles-resource-access-control.md)
87
-
-[Define an Azure Active Directory technical profile in an Azure Active Directory B2C custom policy](active-directory-technical-profile.md)
88
-
89
-
## October 2022
90
-
91
-
### New articles
92
-
93
-
-[Edit Azure Active Directory B2C Identity Experience Framework (IEF) XML with Grit Visual IEF Editor](partner-grit-editor.md)
94
-
-[Register apps in Azure Active Directory B2C](register-apps.md)
95
-
96
-
### Updated articles
97
-
98
-
-[Set up sign-in for a specific Azure Active Directory organization in Azure Active Directory B2C](identity-provider-azure-ad-single-tenant.md)
99
-
-[Set up a password reset flow in Azure Active Directory B2C](add-password-reset-policy.md)
100
-
-[Azure Active Directory B2C documentation landing page](index.yml)
101
-
-[Publish your Azure Active Directory B2C app to the Azure Active Directory app gallery](publish-app-to-azure-ad-app-gallery.md)
-[Extensions app in Azure AD B2C](extensions-app.md)
122
-
-[Manage Azure AD B2C with Microsoft Graph](microsoft-graph-operations.md)
123
-
-[Define custom attributes in Azure Active Directory B2C](user-flow-custom-attributes.md)
124
-
-[Azure Active Directory B2C: What's new](whats-new-docs.md)
125
-
-[Page layout versions](page-layout.md)
126
-
127
-
## July 2022
128
-
129
-
### New articles
130
-
131
-
-[Configure authentication in a sample React single-page application by using Azure Active Directory B2C](configure-authentication-sample-react-spa-app.md)
132
-
-[Configure authentication options in a React application by using Azure Active Directory B2C](enable-authentication-react-spa-app-options.md)
133
-
-[Enable authentication in your own React Application by using Azure Active Directory B2C](enable-authentication-react-spa-app.md)
134
-
135
-
### Updated articles
136
-
137
-
-[Enable custom domains for Azure Active Directory B2C](custom-domain.md)
138
-
-[Set up sign-up and sign-in with a Twitter account using Azure Active Directory B2C](identity-provider-twitter.md)
139
-
-[Page layout versions](page-layout.md)
140
-
-[Monitor Azure AD B2C with Azure Monitor](azure-monitor.md)
141
-
-[Enable JavaScript and page layout versions in Azure Active Directory B2C](javascript-and-page-layout.md)
As threat vectors change, Azure AD may announce default protection for a **Microsoft managed** setting in [release notes](../fundamentals/whats-new.md) and on commonly read forums like [Tech Community](https://techcommunity.microsoft.com/).
title: System-preferred multifactor authentication (MFA) - Azure Active Directory
3
+
description: Learn how to use system-preferred multifactor authentication
4
+
ms.service: active-directory
5
+
ms.subservice: authentication
6
+
ms.topic: conceptual
7
+
ms.date: 02/28/2023
8
+
ms.author: justinha
9
+
author: justinha
10
+
manager: amycolannino
11
+
ms.reviewer: msft-poulomi
12
+
ms.collection: M365-identity-device-management
13
+
14
+
15
+
# Customer intent: As an identity administrator, I want to encourage users to use the Microsoft Authenticator app in Azure AD to improve and secure user sign-in events.
System-preferred multifactor authentication (MFA) prompts users to sign in by using the most secure method they registered. Administrators can enable system-preferred MFA to improve sign-in security and discourage less secure sign-in methods like SMS.
20
+
21
+
For example, if a user registered both SMS and Microsoft Authenticator push notifications as methods for MFA, system-preferred MFA prompts the user to sign in by using the more secure push notification method. The user can still choose to sign in by using another method, but they're first prompted to try the most secure method they registered.
22
+
23
+
System-preferred MFA is a Microsoft managed setting, which is a [tristate policy](#authentication-method-feature-configuration-properties). For preview, the **default** state is disabled. If you want to turn it on for all users or a group of users during preview, you need to explicitly change the Microsoft managed state to **enabled** by using Microsoft Graph API. Sometime after general availability, the Microsoft managed state for system-preferred MFA will change to **enabled**.
24
+
25
+
After system-preferred MFA is enabled, the authentication system does all the work. Users don't need to set any authentication method as their default because the system always determines and presents the most secure method they registered.
26
+
27
+
## Enable system-preferred MFA
28
+
29
+
To enable system-preferred MFA in advance, you need to choose a single target group for the schema configuration, as shown in the [Request](#request) example.
By default, system-preferred MFA is [Microsoft managed](concept-authentication-default-enablement.md#microsoft-managed-settings) and disabled during preview. After generally availability, the Microsoft managed state default value will change to enable system-preferred MFA.
34
+
35
+
| Property | Type | Description |
36
+
|----------|------|-------------|
37
+
| excludeTarget | featureTarget | A single entity that is excluded from this feature. <br>You can only exclude one group from system-preferred MFA, which can be a dynamic or nested group.|
38
+
| includeTarget | featureTarget | A single entity that is included in this feature. <br>You can only include one group for system-preferred MFA, which can be a dynamic or nested group.|
39
+
| State | advancedConfigState | Possible values are:<br>**enabled** explicitly enables the feature for the selected group.<br>**disabled** explicitly disables the feature for the selected group.<br>**default** allows Azure AD to manage whether the feature is enabled or not for the selected group. |
40
+
41
+
### Feature target properties
42
+
43
+
System-preferred MFA can be enabled only for a single group, which can be a dynamic or nested group.
44
+
45
+
| Property | Type | Description |
46
+
|----------|------|-------------|
47
+
| id | String | ID of the entity targeted. |
48
+
| targetType | featureTargetType | The kind of entity targeted, such as group, role, or administrative unit. The possible values are: 'group', 'administrativeUnit', 'role', 'unknownFutureValue'. |
49
+
50
+
Use the following API endpoint to enable **systemCredentialPreferences** and include or exclude groups:
>In Graph Explorer, you need to consent to the **Policy.ReadWrite.AuthenticationMethod** permission.
58
+
59
+
### Request
60
+
61
+
The following example excludes a sample target group and includes all users. For more information, see [Update authenticationMethodsPolicy](/graph/api/authenticationmethodspolicy-update?view=graph-rest-beta).
-[FIDO2 security key isn't supported on iOS mobile devices](../develop/support-fido2-authentication.md#mobile). This issue might surface when system-preferred MFA is enabled. Until a fix is available, we recommend not using FIDO2 security keys on iOS devices.
89
+
90
+
## Common questions
91
+
92
+
### How does system-preferred MFA determine the most secure method?
93
+
94
+
When a user signs in, the authentication process checks which authentication methods are registered for the user. The user is prompted to sign-in with the most secure method according to the following order. The order of authentication methods is dynamic. It's updated as the security landscape changes, and as better authentication methods emerge.
95
+
96
+
1. Temporary Access Pass
97
+
1. Certificate-based authentication
98
+
1. FIDO2 security key
99
+
1. Microsoft Authenticator notification
100
+
1. Companion app notification
101
+
1. Microsoft Authenticator time-based one-time password (TOTP)
102
+
1. Companion app TOTP
103
+
1. Hardware token based TOTP
104
+
1. Software token based TOTP
105
+
1. SMS over mobile
106
+
1. OnewayVoiceMobileOTP
107
+
1. OnewayVoiceAlternateMobileOTP
108
+
1. OnewayVoiceOfficeOTP
109
+
1. TwowayVoiceMobile
110
+
1. TwowayVoiceAlternateMobile
111
+
1. TwowayVoiceOffice
112
+
1. TwowaySMSOverMobile
113
+
114
+
### How does system-preferred MFA affect AD FS or NPS extension?
115
+
116
+
System-preferred MFA doesn't affect users who sign in by using Active Directory Federation Services (AD FS) or Network Policy Server (NPS) extension. Those users don't see any change to their sign-in experience.
117
+
118
+
### What if the most secure MFA method isn't available?
119
+
120
+
If the user doesn't have that have the most secure method available, they can sign in with another method. After sign-in, they're redirected to their Security info page to remove the registration of the authentication method that isn't available.
121
+
122
+
For example, let's say an end user misplaces their FIDO2 security key. When they try to sign in without their security key, they can click **I can't use my security key right now** and continue to sign in by using another method, like a time-based one-time password (TOTP). After sign-in, their Security info page appears and they need to remove their FIDO2 security key registration. They can register the method again later if they find their FIDO2 security key.
123
+
124
+
### What happens for users who aren't specified in the Authentication methods policy but enabled in the legacy MFA tenant-wide policy?
125
+
126
+
The system-preferred MFA also applies for users who are enabled for MFA in the legacy MFA policy.
127
+
:::image type="content" border="true" source="./media/how-to-mfa-number-match/legacy-settings.png" alt-text="Screenshot of legacy MFA settings.":::
128
+
129
+
## Next steps
130
+
131
+
*[Authentication methods in Azure Active Directory](concept-authentication-authenticator-app.md)
132
+
*[How to run a registration campaign to set up Microsoft Authenticator](how-to-mfa-registration-campaign.md)
0 commit comments