Microsoft Entra ID - New External MFA Option Available
Basically, Microsoft now lets users add third-party security checks for logging in.
Microsoft has rolled out external MFA for Entra ID, allowing third-party authentication solutions. This flexibility helps organizations meet compliance needs and enhances security. It's a significant step towards better identity management in the digital landscape.
What Happened
Microsoft has introduced a new feature in Entra ID that allows organizations to integrate external Multi-Factor Authentication (MFA) solutions. This option is now generally available, enabling users to employ third-party identity providers for enhanced security. By supporting external MFA, Microsoft aims to help organizations meet regulatory requirements and ensure a consistent approach to authentication.
This development is crucial for businesses undergoing mergers and acquisitions or those that require a tailored MFA solution. The integration is built on the OpenID Connect (OIDC) standard, allowing organizations to maintain their existing security policies while adding new authentication methods.
Who's Affected
Organizations using Microsoft Entra ID are the primary beneficiaries of this new external MFA capability. This feature is particularly relevant for businesses that have specific compliance needs or those that want to streamline their authentication processes. Administrators will find it easier to manage user access by incorporating third-party MFA solutions alongside Microsoft's built-in options.
Additionally, the external MFA feature can be assigned to specific user groups, allowing for a more customized security approach. This flexibility is essential for organizations looking to enhance their security posture without sacrificing user experience.
What Data Was Exposed
While the introduction of external MFA does not expose any data per se, it does require organizations to grant administrative consent for the external provider to access user information during the authentication process. This means that sensitive user data may be shared with third-party providers, making it essential for organizations to choose reputable MFA solutions that prioritize data protection.
Microsoft emphasizes that the integration of external MFA with Conditional Access policies is designed to align authentication prompts with organizational security goals. However, it also cautions against excessive reauthentication, which can lead to user fatigue and increased phishing risks.
What You Should Do
Organizations should begin planning to configure external MFA in their Microsoft Entra ID settings. This involves selecting a third-party MFA provider and ensuring that it meets their security and regulatory requirements. Microsoft will provide migration guidance as it phases out the previous Custom Controls feature by September 30, 2026.
To ensure a smooth transition, organizations should review their existing authentication policies and adjust them according to Microsoft's recommendations for reauthentication frequency. This proactive approach will help strike the right balance between security and user productivity, ultimately enhancing the overall security framework of the organization.
Help Net Security