Clatent

Technology | Fitness | Food

Passwords

Did you know: SSPR/Password Reset Edition

by Leave a Comment

Did you know if you convert to the combined experience for SSPR and password reset, you can remove less secure phone, email, and text authentication? This is as long as you have Authenticator registered and higher methods allowed. See below for SSPR.

This works for SSPR and for password reset through My Sign-Ins.

The gotcha is if you have 2 methods required for SSPR, it will say your not registered for SSPR even if your enabled for it, but only have 1 method (Microsoft Authenticator) registered. As you can see below.

I would definitely recommend adding more secure options as well but at the minimum I’d use Authenticator or higher.

How do you keep your user protected in this situation?

Hope this quick tip was useful and have a great day!

EntraFIDOFinder Update

by Leave a Comment

June( v0.0.18) update is here and we skipped May as I could tell they were still making some changes so I didn’t push them to the PowerShell gallery. This month they removed 50+ keys as they were unapproved models, but there are still over 150 keys that are Entra Attestation capable!

How is your FIDO2 journey going? What are you wishing this module could do?

Appreciate all feedback and have a great day!

PowerShell Gallery: https://www.powershellgallery.com/packages/EntraFIDOFinder/0.0.18
GitHub: https://github.com/DevClate/EntraFIDOFinder
Web Version: https://devclate.github.io/EntraFIDOFinder/Explorer/

EntraFIDOFinder March Update

by Leave a Comment

We are in March, and looks like no new major changes. I may have to start sending this update out later in the week, as I’m wondering if Microsoft hasn’t updated their page yet.

Some things I did notice were that a few of the YubiKey names slightly changed on the FIDO Alliance database, but haven’t changed on Microsoft side, so I need to wait before I change them on mine so I don’t keep getting errors if it doesn’t match up with Microsoft.

Although, these won’t show up on Microsoft’s website, 3 Yubico keys have received L2 certification now.

  • dd86a2da-86a0-4cbe-b462-4bd31f57bc6f – YubiKey Bio FIDO Edition
  • 58276709-bb4b-4bb3-baf1-60eea99282a7 – YubiKey Bio Series – Multi-protocol Edition 1VDJSN
  • 90636e1f-ef82-43bf-bdcf-5255f139d12f – YubiKey Bio Series – Multi-protocol Edition

I’ll keep an eye out and see if Microsoft updates their naming for the few and see if any other features change, but for now, that is all. No new PowerShell module version until Microsoft puts out an update or features are added, but did add the L2 certifications to the web version.

PowerShell Gallery: https://www.powershellgallery.com/packages/EntraFIDOFinder/0.0.15
GitHub: https://github.com/DevClate/EntraFIDOFinder
Web Version: https://devclate.github.io/EntraFIDOFinder/Explorer/

Have a great day!

October 14, 2024 – Tomorrow is MFA Enforcement day and we have our first FIDO2 key update

by Leave a Comment

Today is the last day before Phase 1 of MFA Enforcement of Microsoft portals being turned on. This includes break glass accounts as well, so make sure you have your FIDO keys, Certs, or a dedicated computer with Windows Hello for Business setup.

You can learn more of the details at Microsoft Learn – https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication

If you want to see what accounts will be affected, check out Daniel Bradley’s great blog at https://ourcloudnetwork.com/how-to-assess-the-impact-of-mfa-enforcement-in-azure/

This past Saturday we had our first update to the FIDO2 key database. The OneSpan DIGIPASS FX1 BIO now has been approved for NFC. It looks like it was updated later on Friday as the page shows last updated on the 11th, but when I had checked that morning there wasn’t an update.

Also, I’ve updated the module to show the change in database as well as when you check which version of the database you have it automatically tells you if it is outdated instead of needing to then run the -NewVersion parameter.

Added Cmdlet Get-FIDODbLog which will show you the database merge log so you don’t have to go to the web to see it and will have it right in your terminal.

PowerShell Gallery: https://www.powershellgallery.com/packages/EntraFIDOFinder/0.0.10
GitHub: https://github.com/DevClate/EntraFIDOFinder
Interactive Key Explorer: https://devclate.github.io/EntraFIDOFinder/Explorer/

Hope this helps with your security journey, and if there is anyway I can help, please feel free to reach out.

EntraFIDOFinder Update

by Leave a Comment

October 15, is less than a week away for the MFA requirement on certain 365 Apps. Please make sure you are all set by then. Make sure to go through all your accounts, especially those old ones that you rarely ever touch, and see if you still need it or what is the best way to protect it now. For some you will be able to delete and others you will need something such as a cert, FIDO2 key, or Windows Hello for Business. For those that will need a FIDO2 key, I’ve pulled from Microsoft Learn the current Attestation capable FIDO2 keys that are compatible with Entra. The database may say that it was last updated September 30, 2024, but I reviewed it today(Oct 9th) and the list still hasn’t changed. Once they do update it, I’ll update mine as well as show the changes.

With that said, I’ve now created a function called Show-FIDODbVersion that will show you what your current version is, and if you use Show-FIDODbVersion -NewestVersion, it will show you the newest version out. Would you rather me, show the difference as soon as you run Show-FIDODbVersion if there is or do you want them seperate?

Also working on automating the update process so that it can be checked daily with minimal intervention.

Are there any other features you’d like to see? I’m going to be adding at least vendor links and I’ve been trying to find pricing, but more than a handful of them do not even show pricing and not sure how valuable it will be if only a few of the vendors have pricing. How critical is cost to you?

I hope EntraFIDOFinder has been useful for you, and I can’t believe it has over 100 downloads already. I wasn’t even going to publish this, but figured there was someone else out there that didn’t want to just look at a static website and scroll through, so that is why I created the module and the interactive webpage.

PowerShell Gallery: EntraFIDOFinder
GitHub: EntraFIDOFinder
EntraFIDOFinder Explorer

Enjoy your day and get secure!

EntraFIDOFinder – New PowerShell Module

by Leave a Comment

After so much interest from my post on Friday, I figured I’d do one better and make a PowerShell module that does it for you. So now you will be able to find which FIDO2 keys are attestation compatible with Entra right from your terminal. In the very near future I will have individual functions for exporting to Excel, CSV, Markdown, and PDF, but know a lot of people like to customize that themselves. I even put a few quick pointers on GitHub for it too, but will be doing tutorials shortly as well.

I’m still cleaning up the GitHub, but it is in the PowerShell Gallery and on GitHub at the links below.

You are able to search by Brand and/or device type such as USB, NFC, BLE, or BIO. These values are all parameter validated so if you do not see a brand that you have, then currently it is not compatible. Here is also the original link I shared on Friday Microsoft Learn FIDO2 Hardware Attestation.

Let me know what you think and do you find it useful. There are a few other features I want to add, but open to any other suggestions or do you think it is good as is?

And don’t forget the mid Oct deadline is coming up quickly for Entra admin portals, good luck!

PowerShell Gallery: EntraFIDOFinder
GitHub: EntraFIDOFinder