So the solution is to enroll the account in MFA and use an app password. When you enforce multi-factor authentication legacy authentication use protocols will be blocked To address this limitation a feature known as app passwords can be used to ensure the application or device will still authenticate. Partners are required to enforce multi-factor authentication for all user accounts in their partner tenant.
Per This document (last updated as of this writing) Assign that policy to your helpdesk account.Įdit this is no longer correct.
DISABLE AZURE SECURITY DEFAULTS UPDATE
Instead, as above- update your default security policy to disable Basic Auth, and create a new security policy allowing Basic Auth for only IMAP and SMTP.
You can't apply the defaults / baseline if you have a Basic Auth device (excepting SMTP). Apply an AAD license to the helpdesk account, add a conditional login policy requiring MFA verification.
DISABLE AZURE SECURITY DEFAULTS PASSWORD
Generate an app password for the ticket system to use. Assign that policy to your helpdesk account.Įnroll the helpdesk account in MFA. Update your default security policy to disable Basic Auth, and create a new security policy allowing Basic Auth for only IMAP and SMTP. Forward your existing mailboxes to the new addresses in your active tenant. Move your automated systems to that tenant. preferred option *Ĭreate a new Office 365 tenant on a subdomain ie. If not, you will need to host a POP or Exchange server to accommodate. You need to contact your ticket system vendor and verify they will support modern auth prior to that date. How can we comply with Microsoft's new demands of having these security defaults enabled, but not break our helpdesk completely? We're using SMTP and IMAP with it.Įdit - prefacing this with the proviso that Basic Authentication is going away entirely next September. I've turned it off for now, but as you know this takes forever to actually occur. Now it turns out that the security defaults actually ARE blocking legacy auth and it breaks our helpdesk completely, it's no longer able to receive new tickets from clients and no longer able to send out our communications to them either. However, as most events related to compromised identities come from sign-in attempts using legacy authentication, partners are encouraged to move away from these older protocols.
0 kommentar(er)
