{"id":385,"date":"2023-06-07T11:59:00","date_gmt":"2023-06-07T09:59:00","guid":{"rendered":"http:\/\/virtualnomad.nl\/?p=385"},"modified":"2023-06-07T10:09:48","modified_gmt":"2023-06-07T08:09:48","slug":"hello-can-we-hang-up-on-voice-and-sms-authentication-already","status":"publish","type":"post","link":"https:\/\/virtualnomad.nl\/?p=385","title":{"rendered":"Hello? Can we ‘Hang Up’ on Voice and SMS Authentication Already?"},"content":{"rendered":"\n

Today, we’re diving into the fascinating world of multi-factor authentication (MFA) and its not-so-equal siblings. Just like in a dysfunctional family, not all MFA methods are created equal. Some are like the overprotective parent who won’t let you do anything without a permission slip, while others are as reliable as your forgetful uncle who constantly misplaces his keys. We’ll navigate through the pitfalls of certain MFA approaches and explore the importance of choosing robust authentication methods to keep those cyber villains at bay.<\/p>\n\n\n

\n
\"\"
Yubico shared this graphic to aware about the risks of every authentication method<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n

There are various types of MFA used in organizations. It is now clear that voice and SMS authentication are out of the question. However, many companies still have users who have these methods set up, making a transition to other options not so straightforward. This transition will take time. To address this, Microsoft has introduced “Authentication Strength<\/a><\/strong>.” An ideal place to begin could involve removing phone and SMS authentication for privileged admin users or for accessing certain sensitive applications.<\/p>\n\n\n\n

Maybe do a check first?<\/strong><\/p>\n\n\n\n

To see which users are using the voice or sms as an authentication method I created a powershell script. It displays the total amount of users and a list of which users are using sms or voice authentication. <\/p>\n\n\n\n

PowerShell<\/span><\/path><\/path><\/svg><\/span>
# Install AzureAD module if not already installed<\/span><\/span>\nif<\/span> (<\/span>-not<\/span> (<\/span>Get-Module<\/span> <\/span>-<\/span>Name AzureAD <\/span>-<\/span>ListAvailable)) {<\/span><\/span>\n    <\/span>Install-Module<\/span> <\/span>-<\/span>Name AzureAD <\/span>-<\/span>Force<\/span><\/span>\n}<\/span><\/span>\n<\/span>\n# Connect to Azure AD<\/span><\/span>\nConnect-AzureAD<\/span><\/span>\n<\/span>\n# Get users with voice or SMS authentication<\/span><\/span>\n$authUsers <\/span>=<\/span> <\/span>Get-AzureADUser<\/span> <\/span>-<\/span>All <\/span>$true<\/span> <\/span>-<\/span>Filter <\/span>"<\/span>accountEnabled eq true<\/span>"<\/span> | <\/span>Where-Object<\/span> {<\/span><\/span>\n    <\/span>$_<\/span>.OtherMails <\/span>-like<\/span> <\/span>"<\/span>*Voice*<\/span>"<\/span> <\/span>-or<\/span> <\/span>$_<\/span>.OtherMails <\/span>-like<\/span> <\/span>"<\/span>*SMS*<\/span>"<\/span><\/span>\n}<\/span><\/span>\n<\/span>\n# Display the count of users<\/span><\/span>\n$authUserCount <\/span>=<\/span> $authUsers.Count<\/span><\/span>\nWrite-Host<\/span> <\/span>"<\/span>Number of users using Voice or SMS authentication method: <\/span>$authUserCount<\/span>"<\/span><\/span>\n<\/span>\n# Display the list of users<\/span><\/span>\nWrite-Host<\/span> <\/span>"<\/span>Users:<\/span>"<\/span><\/span>\n$authUsers | <\/span>Format-Table<\/span> DisplayName, OtherMails<\/span><\/span>\n<\/span><\/code><\/pre><\/div>\n\n\n\n
After this check,  you can decide how to migrate users to a safe and secure authentication method.<\/p>\n\n\n\n
Okey what do we need to do now?<\/strong><\/p>\n\n\n\n
There are some default authentication strengths defined in Azure:<\/p>\n\n\n\n