Sysadmins Wrestle with Microsoft Entra

“We are currently trying to push the Entra registration campaign to our users who are still on SMS. The vast majority of our users just use thick Outlook and thick Teams. We’ve set a conditional access sign-in policy of 1-day for them, so they are regularly required to do MFA. But we can’t get the MFA window in Outlook/Teams to guide the user through the registration campaign, it just logs them straight in after entering their 6 digit text. Has anyone had any success getting registration campaign”

“Hey Reddit, I've tried asking AI and doing some research but getting conflicting information. Can you disable external MS teams users from starting direct chats or calls with users in your M365 tenant while NOT blocking the use of MS teams for meetings with external users and/or direct calls via DID's assigned to Teams users? submitted by /u/reddit-user-seven [link] [comments]”

“That seems like a clean way to contain the exposure — block DCF by default and keep the exception group limited to the Teams Rooms accounts that actually require it. Have you had any issues with those Room accounts during reauthentication or reprovisioning, or has the exception group been enough to keep things running reliably?”

“That sounds like a sensible approach. Blocking it by default and keeping the exception limited to the specific service accounts that genuinely need it seems much cleaner than leaving Device Code Flow broadly available. Adding the IP restriction is a good extra control as well. Have you run into any issues with those service accounts during reauthentication or if their expected network path changes?”

“I feel you… I think there is no way as IT most likely can see everything your MS365 is connected to.”

“I'd block it by default and only allow legit exceptions. I'd monitor those sign-ins too, since CA ins't the whole story.”

Yes it is CE+

Thanks, Claude

You absolutely can scope it by app. What slop is this.

“I've been looking more closely at Microsoft's recent reporting around device-code phishing. The part I find interesting is that device-code authentication itself is legitimate. The problem is that attackers can abuse that trusted authentication flow by convincing a user to authorize a session. For M365 environments, that raises a practical question: Are you blocking device-code authentication completely with Conditional Access, or keeping it enabled for specific users/devices that still”

“Check for a Credential Guard or LSA protection setting still applying from the baseline exclusion, those can strip autologon even after you pull the profile. Also worth confirming the password isn't being cleared from LSA secrets rather than the key itself being reset.”

“The owner of the company at one of our MSP customers just had something unexplainable happen. This may shock you but Microsoft is involved. She forgot her email pass to log into a brand new mobile device. I went to change her password and it threw the error "This user's password can't be reset because password writeback isn't turned on for your organization." Their o365 cloud stuff doesn't touch their local DC AT ALL. As far as I know, it never has, but that may not be”

“I wonder how this change will impact things, perhaps TAP won't be required somehow? https://mc.merill.net/message/MC1450133”

“why do you we need a custom way around this Because they way Microsoft implemented this is completely and utterly brain dead. Just look at the documentation about conditional access policies and authentication methods, there's so many exceptions and special cases cluttered across multiple documents, nobody can fucking understand the bullshit they built. I'm currently implementing passwordless and CBA and I truly want to punch the engineers in their fucking face.”

“What are you using for an MDM? Assuming these are corporate owned devices and not BYOD. Any sort of security? Policy enforcement? mTLS? That last one specifically is absolute trash on Samsung phones.”

thats the remedy to those issues , service account primary owner.

“Yes thats the plan in motion because there has to be some sort of process and control.”

“we donot allow emails on personal phones, need vendors to see alerts and such, looking for a secure way rather than adding exclusion for the users edit: sorry yeah I mean contractors, especially overseas contractors submitted by /u/as0909 [link] [comments]”

“Because we have other platforms besides Azure, as well as applications that need secondary authentication for certain functions, and want a single MFA tool that covers all use cases. There are some things MS native MFA can't do.”

“Merges better for alot of components versus just using MS Authenticator. In our subscriptions we have it tied to ipsec VPN users, AD accounts, SSO with other applications.”

“I have been looking into setting this up, but I don't see any information on whether it can be setup in hybrid-mode environments or not, does anyone know? Thanks, submitted by /u/3G_Lighting [link] [comments]”

“Can’t you setup a passkey in Microsoft Authenticator without needing lock code?”

“For existing users w mfa setup do you just have them browse to myaccount.microsoft.com and change from there? iPhones should have password app by default unless someone deleted it but good call that autofill is what I have everyone check before setting it. One other item … if someone has no biometric / security setup on their phone they can’t setup a synced passkey”

“If using WHfB, how does that work for IT people? IT needs it for standard and admin accounts, RDP, logging into user desktops, etc. If standard users are set up with WHfB but IT has a different option, what 2nd option works well with WHfB? If IT logs into a computer set up to use WHfB and that IT person isn't set up to use it, what is the MFA option for them on that desktop? BTW...are certs an option? I know in general certs aren't considered MFA but within Entra, I am pretty sure certs”

“Should be able to. I have zero experience with edge and little in m365 account but there should be no reason it wouldn’t work.”

“A jump box to remote into a Privileged Access Machine with a dedicated account to do any day to day work. We allow internet access on those machines to Microsoft domains via firewall. The account used for 365 administration is not AD synced and requires its own MFA.”

“Yes, and you don't have to leave Microsoft managed to do it. Include and exclude targets stay configurable in either state, its only the method, the snooze duration and the snooze count that get locked when Microsoft manages it. Its in the state description at https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-registration-campaign For a proper pilot set state to Enabled, put the test group in includeTargets with targetedAuthenticationMethod microsoftAuthenticator, an”

“Not if you're using the Microsoft Managed feature. Swap it to enabled to target (or exclude) a group.”

“Hello folks, We’ve been tasked to switch some of our users from SMS to the MS Authenticator app. Rather than doing this manually, I’d like to make this seamless as possible. I think creating a policy in entra ID where it’ll prompt our end users to enroll into MS Authenticator ? Curious to know how others have tackled this. submitted by /u/elitesparten117 [link] [comments]”

“EDIT: this is mostly the ideal solution for MSPs, not single companies. But it may still apply based on your users' knowledge level and company hardware. I got out ahead of this project because it was a light day. If you didn't hear, MS is shutting down SMS 2FA on Feb 1st 2027 because SS7 is comically insecure. They're also shutting down the phone call system on the same day, to ensure the most people get locked out of their accounts as possible (I assume). But enrolling users in MS”

“One man IT show here in manufacturing. On the verge of finding a bridge to skydive from lately... Microsoft moving goalposts constantly and security becoming a living nightmare in general has me feeling like I'm drowning lately. Everything is moving too fast recently and I have only been doing this for ~13 years. Feeling a bit overwhelmed lately so I thought I might ask some folks who might specialize in 365/Entra administration more so than generalize like I am forced to. I wear so many hat”

“So, MS is sunsetting SMS/Voice MFA in favor of passkeys or more phishing resistant methods. Currently I have all my users set up for Authenticator push notifications/with the numerical code. Is this method going to be supported moving forward? submitted by /u/evil-scholar [link] [comments]”

“My employer uses it too and I hate it as well, mainly because it’s linked to entra id.”

I am a sys admin but not the sys admin of o365

This sounds spot on, do you have a link to a guide detailing this? Otherwise I'll go hunting for one. Thanks.

“Hi guys, we had a client whom had a hostile takeover of their 365 admin portal who assumed GA (MFA/OTP and everything was enabled so not sure how it happened but that will need to be investigated after). Attacker stripped the breakfix account as well and we are kicked out. We logged a job with the MS data governance team whom are barely replying and it's been a day and a half. We've tried calling the number but just get bounced back saying they will look into it. We've asked them to”

“actually, one other thing you might know: in the upcoming nudge to passkeys , if a user has authenticator AND sms registered, are they going to get nudged to create a passkey?”

“Yeah, looking forward to this sub in September when all the Entra admins who don’t read notifications start asking about this stuff.”

“Why? Legitimately, why? Passkeys are easier and more secure. Why train end users on something to have to retrain them again on passkeys? It will just lead to confusion and frustrating”

“If you got the email about Microsoft retiring SMS/voice MFA, you probably only caught two dates: Sept 1, 2026 — Entra auto-enables passkey registration nudges for anyone currently on SMS/voice Feb 1, 2027 — Microsoft-provided SMS/voice is fully retired, no exceptions What the email doesn't call out: there's a temporary opt-out for the Sept 1 part. It won't move your Feb 2027 deadline but it stops Microsoft from flipping on the registration campaign and hitting your end users with &qu”

“I don't understand how it's still around and used even though Microsoft has 'deprecated' it multiple times? I moved everyone off if it back in 2024 for that reason. And turns out it's still in use.”

“Can it just be joined with the 365 admin? Or do you create a separate user?”

“Hey folks, I have been a bit confused about the scope for the september change on the passkey nudge campaign in relation to SMS & Voice MFA deprecation. Currently in our Auth method policie, we have enabled the option for SMS for "All users". However, only a small fraction has it enabled when looking in user reg details. Originally i thought we didn't rly need to do much. But, then i read the MS FAQ and got a bit worried about this line " On September 1, 2026, users enable”

“GPO is the wrong layer for this since the phones are not domain joined, so Conditional Access is where you actually get a decision. The thing to watch is that a published block and an effective block are not the same here. Legacy and basic auth paths, and clients that fall back to ActiveSync or IMAP, tend to slip past a policy that only names the modern apps, so you end up with a rule in the portal and mail still flowing on the device. Test with the sign-in logs rather than the policy summary, f”

“I’m trying to figure out how other places with shared/public computers deal with. They don’t prohibit MFA devices like phones is how. You’re looking to solutions for problems you cause, so just fix the problems.”

“Some people have a personal phone, some don’t. They can’t reliably go get their phone whenever they want though is the issue. I do have a work issued cell phone that I’m thinking of using for something like this”

“You can configure the Outlook settings with Group Policy. Ideally if your environment is using Entra Connect, then you can set it up so the user automatically signs in.”

“The Outlook part of this is not really an Outlook problem, it is a UPN problem. Outlook signs in with the account's user principal name, not the mail address, so if the on prem UPN and the tenant sign-in name are different the client will keep prefilling the wrong value and no amount of retraining sticks. If the on prem UPN suffix is something like a .local domain, that is exactly the symptom you are describing. The durable fix is to make the UPN match the primary SMTP address for every user”

“why do policies seem to switch on and off in that interim period? A ton of Microsoft's services only sync changes to the global network of Azure/365 endpoints on quite literally a "When we have time for it" schedule. On the backend there's a queue, but that queue is massive and based on priority. If a change with a higher priority comes into the sync queue, your low-priority CA policy change gets pushed down the list until all the high-priority changes are processed or until th”

“We enforce “strongest auth first” so we don’t have this problem.”

“Does anyone know if having 2FA through the Authenticator app will be sufficient or does it have to be a passkey. Will everyone without a passkey be prompted? Their vagueness on important things is always interesting.”

“This, why in gods name are people still logging in as new users to “setup things” outlook should auto configure and printers can be automated via Intune with scripts”

“Edit: Sorry just re-read your post and realised I missed that it's for only certain users. Entra P1 is extended functionality for user security. The main one being Conditional Access. If you use CA policies that affect the non BP users or admin accounts, yes, you need Entra P1. However, if you are only using CA to enforce MFA, you can do that manually against the account, which is good for Admin accounts Also Entra P1 is ~£5 per user per month, which is about £60 per user per year Firstly, E”

“At least you don’t have an IT Manager who calls it access control instead of conditional access!!”

“At least they send you notification. The way I find out an employee is traveling is I get an email "Hey, so-and-so can't log in"”

“No they're not. As you grow larger and larger there are groups of users that need access to subsets of things or other roll up products. Instead of being able to put a department security group into something else now you need a unique group for that department for that app.”

“I don't understand what Entra is even for. It's supposed to be an ID service but it doesn't actually federate properly, not even with Microsoft's own products. I feel like Microsoft is determined to destroy everything that made AD a no-brainer product to buy.”

“Your Android observation is correct and the iOS setup really is more manual for BYOD. Work Profile is built into Android's OS so the MDM agent triggers it automatically, but iOS has no equivalent container. What matters for your colleagues is which enrollment type IT choses: full device enrollment lets IT see all installed apps and some device details, while Apple User Enrollment (the BYOD-intended option) cryptographically separates managed data and hides personal apps from IT, similar to w”

“This! It isn’t an MSP you need it’s a CSP. I work for a MSP, what saves our asses in situations like this is being able to pull in CSP reps. Microsoft doesn’t give a fuck about us any more than they do anyone else. But a CSP is millions of $ per month so they have access to better support and have pre vetted the problem isn’t something Microsoft doesn’t want to care about.”