- Announcement (2013) - Released
- Announcement (2014) - Added to many Office 365 plans
- MSExchange.org three part series on configuring and deploying
- My username
- My domain password
- The code that has been texted to my mobile device
Perfect, one thing known by a few people, one thing known to one, and one thing I need to have.
You can also see here that I can select to not use the MFA for 60 days. This is actually a setting administrators can choose to allow or not. However, not allowing it, the box still appears, so your users can click it all they want, they will be needing their mobile to sign in to any web services. I really think if it isn't allowed by your administrator, the option should never be displayed, it just makes users think that something is broken.
When you first sign in after enabling MFA on an account, you will be prompted to enter or update your phone numbers used for account security. This is actually pretty neat, and as you can see there are multiple methods of MFA available to your users.
Of course, there are some things that do not work with MFA at all. Thick clients, OneDrive, Word/Excel/Outlook. The answer for this are app passwords. The implementation of MFA also prevents powershell access to your tenant, and app passwords do not work for PowerShell.
App passwords are also:
- all 16 characters
- all lower case alphabetical characters only
- can not be set to expire
- can not be individually managed by administrators
They can be disabled entirely by administrators, but that rules out a lot of functionality for your MFA enabled users.
As shown above, the "Name" of your app password means nothing and is entirely for users to label/remember where they used it. Also, Admin's can't "reset" an app password, the user needs to self manage these.
In all, the MFA implementation at this point works pretty well for users, but can introduce more security related helpdesk tickets with the way app passwords are implemented. And for Admin accounts MFA is fairly useless. Most things I need to do I do in PowerShell. Also, if you work for a very tightly secured organization, the lack of app password manageability or oversight could prevent your InfoSec team from allowing you to use it.