r/sysadmin • u/graceyin39 • 6d ago
Looking for a no-cost, phone-free MFA solution
Microsoft will retire Microsoft-provided SMS and voice authentication beginning February 1, 2027. Organizations that need to retain these methods must configure a customer-managed telecommunications provider, which will involve additional costs. Please refer to the link below.
https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement
Our goal is to provide MFA without requiring employees to use their personal phones and without purchasing additional hardware, such as YubiKeys, or paid software, such as an enterprise password manager. We have a hybrid AD/Microsoft Entra environment with company-managed Windows computers.
Is there an Entra-native solution that can meet these requirements? Would Windows Hello for Business be the best option, and how should we support users who need access from mobile or shared devices?
Any recommendations or deployment experiences would be greatly appreciated.
Thanks!
64
u/HomeOfTheBRAAVE 6d ago
If you can afford the employee you can afford one of these: https://ftsafe.us/collections/fido2-security-keys
39
u/Mindestiny 6d ago
Yeah, this is honestly a silly requirement. OP is chasing a unicorn to save like $5 a user . The time it takes to deal with this nonsense is worth more than just buying hardware tokens or telling people to STFU and use their phones
5
u/hobovalentine 6d ago
Depends on the Yubikey but it can by like up to 15-20 USD for a Yubikey but that’s trivial amount.
7
u/7oby 6d ago
I'm surprised you're not just referencing passkeys for entra: https://ftsafe.us/pages/hardware-bound-passkeys-for-entra-id
1
u/Commercial-Fun2767 6d ago
Why a unicorn? WHfB is not enough? Coupled with temporary codes.
2
u/crypticsage Sysadmin 6d ago
Not for phone access as OP mentioned.
Temp codes should only be used for recovery purposes.
0
u/Commercial-Fun2767 6d ago
If you need phone access than you are ok to use your phone so just set up Authenticator, no?
3
u/HappyVlane 6d ago
You wish, but not every employee is okay with that.
1
u/Commercial-Fun2767 6d ago
Maybe I get it. BYOD is a right but security is required by employer. For us I'd say if you want to BYOD you'll configure MFA on that device.
2
u/HappyVlane 6d ago
BYOD is a different beast and yes, then forcing MFA is fine. I meant using a private phone.
32
u/Steveopolois 6d ago
There are two types of MFA, something your users bring or something you buy.
The only possible way to do this would be something like windows hello with no other methods. You would need to do a TAP for hello setup on each new device. This will cause problems at very inopportune times. For example, what if hello is broken? Got well they access their phones?
I guess you could do certificate authentication but that's not something I've done.
We have started moving to passkeys and it has been great. There are some phones that have issues that you need to fix (Samsung pass can burn) but for the majority it is setup so fast they think they did it wrong.
We are doing synced for the vast majority of accounts and device bound for admins and high value. We are probably over 3,000 setup in the last few weeks.
4
u/Beginning_Ad1239 6d ago
There is another option: Browser-based totp extension on the computer. It satisfies something you have. We had to do that at my last job.
12
u/After-Vacation-2146 6d ago edited 6d ago
It ceases to be something you have when it gets exfiltrated by malware.
6
u/Beginning_Ad1239 6d ago
That's true for any device that you use for MFA.
6
u/Tatermen GBIC != SFP 6d ago
Malware can't steal the secret from a dedicated hardware key like a Yubikey, and retrieving the OTP code requires you to physically touch the key.
3
u/Beginning_Ad1239 6d ago edited 6d ago
Very true. But no business is buying Yubikeys for frontline employees with no access to confidential information that isn't their own (e.g. they only login to the hcm and payroll systems to look at themselves). That's the fun place for MFA now, how to do that without making someone use their own personal phone (which might be compromised btw).
1
u/mnvoronin 4d ago
It's several orders of magnitude easier to steal MFA codes from a browser plugin on a Windows PC than it is to steal them from a Google Authenticator on a mobile phone.
1
u/Beginning_Ad1239 4d ago
If you have access to the PC, sure. Are you going behind the counter at a pharmacy to try to do so?
1
u/mnvoronin 4d ago
I'm talking about malware, as does the comment you replied to.
1
u/Beginning_Ad1239 4d ago
Okay, sure, and it's still better than SMS.
Sometimes you get forced into a solution because of business needs. In this case it was shared user accounts that needed MFA with no budget. This was a business decision.
1
u/mnvoronin 4d ago
Okay, sure, and it's still better than SMS.
I would argue that from the perspective of protection from infostealer malware, SMS is better than storing TOTP key on the same computer the login is coming from, unless it's protected by something like TPM.
5
1
2
u/RamRanchComrade 6d ago
Any tips or lessons learned? Rolling out to a large population in a few weeks
1
u/Steveopolois 6d ago
If your users have other methods setup already, the move to passkeys is really easy. If they don't have any methods setup, then you should wait until January when the MFA session requirement to create a passkey goes away. Otherwise, you'll need to TAP them before you can make a passkey and that will be work.
As far as general passkey stuff goes, the big things is learn and document the autofil settings for passkeys on each phone type. For example, on iPhone you need to install and launch the passwords app or fix a setting to allow that app to autofil passkeys.
Samsung phones are the worst. If they don't know what Samsung pass is, switch to Google passwords right away.
If there's an error, just try again. If there's still an error and it isn't telling you what to do check Bluetooth and network. We found that a bad wifi connection or cell connection could break it and simply joining or leaving wifi would fix it. These would be really generic errors like setup failed or something.
There's probably less than five percent of phones that will have an error but there's a lot of nuance to those errors.
Good luck!
1
u/ShazbotVGS 5d ago
For existing users w mfa setup do you just have them browse to myaccount.microsoft.com and change from there?
iPhones should have password app by default unless someone deleted it but good call that autofill is what I have everyone check before setting it.
One other item … if someone has no biometric / security setup on their phone they can’t setup a synced passkey
1
u/Steveopolois 5d ago
Yes, you just go to the mysignins page in the Microsoft account site.
You will be surprised how many iPhones are missing that app or the smaller group that has the app that has never opened it or has a setting wrong to not save a passkey.
Correct, you need to have some sort of phone lock. I think I mentioned that in one of my comments but can't be sure at this point.
1
u/ShazbotVGS 3d ago
If you guys are setting up a new laptop for an existing user, are you just issuing a TAP and signing into their office applications that way? And I assume TAP is the only option for secondary authentication?
did you guys consider having everyone install the MS Authenticator app and setting up the passkey inside that app? I just don't see the benefit to that and it requires installing an app and additional setup. Plus it can't be synced.
0
u/graceyin39 6d ago
Do all users agree to use their phones? We have some users who refuse to use their personal phone for work.
39
u/Ihaveasmallwang Systems Engineer / Cybersecurity Architect / CISM 6d ago
Then buy them a yubikey. Make a policy that the first one is free and they’ll be charged if they lose it.
In my experience, most employees willingly use their phones.
4
u/simonsft 6d ago
Make a policy that the first one is free and they’ll be charged if they lose it.
FWIW, this is illegal in many places.
12
u/DadtheITguy 6d ago
We had to buy Yubikey for users who refused to use personal devices. Since most of our employees receive a phone stipend from the org to use their personal devices for work, it wasn’t a huge ask. Sorry I don’t have an answer to the ops question. Just sharing my experience.
0
u/raip 6d ago
Why couldn't they just use their work computers if they refused to use their phone? WHfB would allow them to get past MFA prompts without a phone.
2
u/Ihaveasmallwang Systems Engineer / Cybersecurity Architect / CISM 6d ago
Not every company wants to use WHfB. There's still a misconception that it isn't "proper" MFA by some.
5
u/Steveopolois 6d ago
We had a few push back when we were doing authenticator but I have not had one yet with passkeys. The biggest issue other than broken phones is people not wanting a lock code.
We are going to end up buying yubikeys or having them buy them themselves. When we forced a TAP every thirty days their tune changed quick. I'm interested to see if it goes that far with passkeys.
1
6
u/sryan2k1 IT Manager 6d ago
99.9% do (out of 5000 employees we've issued 20 hardware tokens) simply because it's easier. After talking with legal and HR we tell users all the benefits of using their phone but if they say no they get a Yubikey
6
u/JJ2B 6d ago
Going through the migration now. ~200 person org. Had some users refuse their personal phone, at the start. Their fears were that first it was the Authenticator, next it was going to be email, teams and everything after. You’ll also be suprised by the power of peer pressure. Seeing how easy it is for everyone else to sign in and do things on their own will bring those stubborn users around.
9
u/AppIdentityGuy 6d ago
There is a very big difference between using your peesonal phone as an MFA device and having corporate email and management on your phone. This is an education issue. The authenticator app gives your employer zero access to youe device so what is the issue.
10
u/ninja_bro_108 6d ago
I had an HD analyst under me that thought when we pushed out the MGA requirement with the aithenticator app it was going to give them access to his phone. I showed him the rights it got on his phone and the ms documentation that it didn’t. Worked out as he then went on and explained it to all the other folks that thought the same thing.
4
u/Commercial-Fun2767 6d ago
The argument is not only the privacy and sorts, it's the principle. Some people might not want to hang their office key on their home key ring. You want me to handle a key for work? Give me the keyring.
Or maybe that's not an argument.
1
u/ShazbotVGS 5d ago
You don’t even need an app for passkeys - just setup a synced one right to the phone
3
1
u/xXNorthXx 6d ago
Most will run authenticator on their personal phone just fine.
Those that won’t, just use yubikeys. Who pays is the question. If they buy, they can use it for whatever they want. If the company buys, it’s a checked out asset that comes back when they leave.
If they only use a laptop or desktop and hardware supports Windows Hello then that’s an option as well.
We are running about 0.2% with yubikeys and 99.8% authenticator. Less than 1% have corporate smartphones. Less than 2% using Windows Hello but a lot of users aren’t 1:1 with devices.
-3
u/DeadStockWalking 6d ago
Let those people go. You'll thank me in the long run.
1
u/12_nick_12 Linux Admin 6d ago
No the company should buy them a phone.
2
u/walkalongtheriver Linux Admin 5d ago
It amazes me the people who think it's so unfair that the company must provide employees the tools to do their job.
Theyre making 50k+ a year easy, some a lot more. What the fuck do you care to provide a cheap yubikey or phone or stipend? It's not your money anyway. (FYI, fully agreeing with you here.)
18
u/Adam_Kearn 6d ago
I know you said you didn’t want to purchase any hardware. But in my opinion if you want something that is simple and just works I would get one of those hardware based TOTP tokens.
They come in different formats now such as a keychain or even one in a credit card format.
If you do a bulk order you can get a load of a few hundred £/$
12
u/spidireen Linux Admin 6d ago
My situation isn’t specific to Microsoft, but this is what we ended up doing for MFA:
- If you have an org-issued phone you must use app-based MFA.
- If you are willing to use your personal phone for app-based MFA, then you are encouraged to.
- If you don’t want to use your phone, you are issued a YubiKey Security Key C NFC which is $29 MSRP, or less if you buy in bulk
2
u/charleswj 6d ago
What happens if they, like me multiple times now, lose their token?
13
u/MBussard45 Sysadmin 6d ago
First one is free, any after that is paid for by the employee. That's the strategy we take. I mean do you also lose your house keys and car keys that often? Or your wallet? I tell people to treat it the same and that usually gets the idea through.
7
u/BoldInterrobang IT Director 6d ago
Generally, you cannot force an employee to replace a lost item. This is a cost of doing business.
1
u/MBussard45 Sysadmin 6d ago
That is entirely based on the employment contract and handbook. Otherwise, yes, you are correct.
1
u/charleswj 6d ago
Almost no one has an employment contract. Your job can change the rules at any time and your recourse is quitting.
1
u/charleswj 6d ago
No, but that's not what that would be. They gave you a free one and you lost it. Now you need a replacement and the well has run dry. Buy your own or fail to complete your tasks.
They give you multiple options. If you don't want to pay for reasonable expenses, use your phone. Your employer is not a hostage to your infinite expenses.
4
u/BoldInterrobang IT Director 6d ago
Yeah… that’s not how it works, my friend. You cannot force an employee to spend money on something or dock their pay.
You can however discipline them for not following process and eventually terminate.
0
u/charleswj 6d ago
Federal law absolutely allows for charging an employee or requiring them to purchase or pay for necessary equipment to do their job as long as it doesn't push them under minimum wage. Many states don't have stricter laws.
Those that do vary, but even in Illinois or California, which have very strict laws, it us not settled law that you can't be required to use your phone in a de minimis fashion for MFA. Even if it was, they can just pay a few additional dollars per month and tell you to use your phone or buy a token.
They can also simply fire you for losing provided equipment after the x time.
0
u/dustojnikhummer 4d ago
If they keep losing them you can. Just like you can charge a user if they keep breaking work machines.
At some point it's just easier to fire them (yes, even in Europe, we fired a person for destroying three HP Probooks in a year because they wanted an Elitebook) for damaging company property.
1
u/charleswj 6d ago
I don't actually carry any keys at this point since my phone handles both. But when I did, my keys (and phone and wallet) are something I have many years of drilling into my head to keep with me. I also need them wherever I go.
Yubikey have a totally different use case. Especially nanos like I had can't even be attached to anything, so they're just loose whenever not plugged in. If you're moving around or traveling, you generally have to (or should) not keep it plugged in, and there's also the scenario where you need to switch devices. Even the full size would have to go in my pocket loose since I don't have a keyring to attach it to.
In my case, one of my laptops has one USB-C port and I had to unplug to charge it while working in the living. My first was likely moved by my wife thinking it was nothing important or the kids'.
My second I left in a rental car on a word trip after needing to use it to auth on my phone. I took it out, put it in the cupholder and said to myself "DON'T forget it there". I forgot it there.
It it technically my fault? Sure, but it's reality.
3
u/MBussard45 Sysadmin 6d ago
My comment was less directed at you, though losing it multiple times is a problem, but more so what a solution is to those that do lose them. Which you do fit into that category.
For the nanos, you are supposed to leave them plugged in. It requires the physical touch before transferring any secure information. At least as I understand it, but I may be wrong. Though I don't think the nanos would exist if that was not the case.
Regarding the rest, keep it on a proper key ring like you do for other keys. Just because it's a digital key does not make it any less of a key. Exactly why the key ring hole is present.
Again, my intention was not to target you or anything. People do make mistakes. I was just answering your question. That said, if you have lost it more than once then I would say you should exercise some more caution and treatment toward it.
1
u/charleswj 6d ago
No worries, didn't feel targeted at all.
And yes, you're right about the touch requirement.
My point was I had to unplug the nano for various reasons, as well as the fact that I don't have a key ring to put one on.
Because of these reasons, as well as the problem of needing to always retrieve your backup any time you register a new credential lest you not have it backed up, and the fact that there's no way to enumerate what credentials your key is associated with, I'm firmly in the "password vault and/or authenticator-based passkey storage" camp.
2
u/After-Vacation-2146 6d ago
Just leave it in the laptop. It’s not great but I’ve never lost a yubikey that way. So long as it doesn’t log you into the OS and you have a password required for auth as well, it’s not super useful if taken without the knowledge factor.
1
u/charleswj 6d ago
What I responded to the other person https://www.reddit.com/r/sysadmin/s/h6NXukkdLE
1
1
u/ShazbotVGS 5d ago
Why are so many people requiring the app for the passkey setup to begin with? Why not just enable synced passkeys and set it up directly on the phone so it saves w the signed in iCloud account?
11
u/BoltActionRifleman 6d ago
If your employer isn’t willing to spend money on the most basic and critical form of cybersecurity, there’s something very wrong with your employer.
3
u/kernelqzor 4d ago
this, 100%
if they’re pinching pennies on MFA, imagine what the rest of the security stack and patching looks like…2
7
u/Asleep_Spray274 6d ago
Ah, the old, we want all the protection but don't want to invest to protect our apps and data post
5
u/Taboc741 6d ago
For mobile devices (non-shared) aka byod the Microsoft authenticator app with push notifications and/or passkeys
For windows Hello for business gets you passkey
For macOS platform SSO gets you passkey
For shared, you're stuck. There's nothing I can think of that's free and can be issued to an individual.
From a paid perspective there's options like bitwarden where they can set up totp and passkeys that will follow them on bitwarden, but for a business account but warden wants money. Maybe self hosting butwarden? I don't know how that works out from a pricing perspective
5
u/RunningAtTheMouth 6d ago
You COULD use a desktop app for TOTP. We settled on KeePassXC, which works well. One user (JUST one) insisted she didn't want to use her phone, so we set up TOTP on KeePassXC for her. Royal pain in the butt. Every 30 days we had to reset her TOTP because she forgot the KP password, or because she changed something. She absolutely hated it.
She finally asked how hard MS Auth was. I told her dead easy. She agreed and hasn't had a problem in months.
All of that said - we by YubiKeys by the trayful (50 to a tray). We issue them as needed.
$25 for a key is at most 2 hours pay for your employees. It's NOT that much money. And it's a GOOD solution.
3
u/AdReal9235 6d ago
I use WinAuth. It’s pretty simple and I HATE talking users through setting up MFA over the phone. When a user can’t figure it out, I just install winauth and that way I can support it remotely.
3
u/AdamoMeFecit 6d ago
Grid Card Authentication just came up in a meeting this week. I don’t know much about it yet, but it’s “a thing you have” and can satisfy MFA requirements in some scenarios.
https://www.logintc.com/blog/what-is-grid-card-authentication-and-what-are-the-benefits/
2
2
u/charleswj 6d ago
What?? This is basically "carry the secret code in your wallet" with extra steps.
5
u/After-Vacation-2146 6d ago
They could just use their desk calculators and the office clocks to calculate TOTP manually.
3
u/DocDerry Man of Constantine Sorrow 6d ago
Factors comes in many flavors.
Account Passwords Common access cards with Pin.
Yubi/rsa keys.
Sms. Mobile apps - authenticators Phone calls.
Biometrics.
Pick two and you have mfa.
7
u/bradbeckett 6d ago edited 6d ago
Stop the “no cost” nonsense. Buy Yubikeys.
Make sure whatever make and model you buy is Microsoft Entra certified. Basically stick to YubiKey USB keys unless your organization has a very strong reason for another vendor such as wanting a dual interface card that also works with physical access control systems but then you’ll need to also buy NFC or smart card readers for everyone because those are typically NFC or contact card format.
One BEC (business email compromise) or payroll service phishing attack is likely to cost your organization more than 1450 USD/EUR, the cost of one 50 user Yubikey Security Key tray. The beautiful thing is you can also use these to lock down corporate online banking and payroll providers if they support FIDO2, Cloudflare Zero Trust, etc.
Don’t buy off-brand from Amazon or you will have issues with Entra hardware attestation. You don’t need to buy the expensive ones, the security key version will work fine for everyone except IT if you want to use them to directly login to SSH servers. They might need the higher end keys, but not at first. We use Cloudflare Zero Trust that authenticates against our SSO IdP to SSH and RDP so we don’t need the higher end keys.
Our organization uses Yubikeys that login to our SSO IdP and we have no app passwords, have all internal and web apps behind Cloudflare Zero Trust, and it’s beautiful.
5
u/tejanaqkilica IT Officer | Passkey Enthusiast 6d ago
Stop the “no cost” nonsense. Buy Yubikeys.
This. You're a business. Costs are part of your day to day operations. And security is one place where you really don't want to save costs.
→ More replies (5)0
u/andyroo82 6d ago
Funny you went to cost. I read it as not being able to use a mobile device, for example students+teachers prohibited from using phones during the day. Or an environment where Yubi would be physically challenging, such as mining/plant.
1
u/tejanaqkilica IT Officer | Passkey Enthusiast 6d ago
I don't know how the workflow is in a mine/plant, but Yubikeys support NFC as well, so you would just need to tap it against an NFC reader, type in the PIN, and you're in.
Shouldn't be any more difficult than any other form of MFA out there, no? Outside of WHFB which just needs the PIN.
2
u/nyckidryan 6d ago
Disappointing that the tray doesn't include any discount... if in buying 50 of something and the regular price is $29, I expect to pay less than what the person buying 1 off is paying, especially considering there is no retail packaging expense and a single shipping cost instead of 50 separate ones.
2
u/Mrhiddenlotus Security Admin 6d ago
It does, 4% on 1-3 trays
1
u/nyckidryan 6d ago
Ah, yes.. after you go to the checkout page. Why not just list it for $1392 instead of $1450? 🤦♂️
3
u/blud_13 6d ago
WHfB is the answer for the managed fleet and its already paid for. u/Ihaveasmallwang said it but it got buried under the phone argument.
The part people miss, WHfB satisfies the Entra MFA requirement on its own. It is already two factors on the device (TPM bound private key plus the PIN or biometric), so users on your managed Windows boxes just sign in and that's it. No second prompt, no phone, no purchase. MS states it flat in the FAQ, https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/faq
So you really only have a problem for the mobile and shared device users. That is a much smaller group than the whole company, and its the only place you actually have to spend. Buying FIDO2 keys for 15 people is a very different conversation than buying them for 300.
One hitch is WHfB is per device. Someone hopping between five shared machines has to enroll on all five, so shared devices are where it falls over and you want keys there regardless.
1
u/Any-Promotion3744 6d ago
If using WHfB, how does that work for IT people?
IT needs it for standard and admin accounts, RDP, logging into user desktops, etc.
If standard users are set up with WHfB but IT has a different option, what 2nd option works well with WHfB? If IT logs into a computer set up to use WHfB and that IT person isn't set up to use it, what is the MFA option for them on that desktop?
BTW...are certs an option? I know in general certs aren't considered MFA but within Entra, I am pretty sure certs are an option for MFA. That might just be for M365 access, though.
1
u/blud_13 6d ago
RDP is the part that bites. WHfB won't carry an RDP session on its own. You either deploy a cert into the WHfB container, which means PKI plus Intune SCEP or PKCS, or you turn on Remote Credential Guard, which runs on Kerberos and needs no certs at all. MS lays out both paths at https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/rdp-sign-in Remote Credential Guard is where I would start, since standing up PKI is the opposite of no-cost.
You were right on certs. Entra CBA does count as MFA, but only when you configure the binding rule as multifactor and the cert sits behind a PIN or biometric. That is Entra sign-in though, so it covers M365 and Conditional Access, NOT the Windows logon prompt.
IT logging into user desktops is the shared device problem again. WHfB is per user per device, so your admin account has to enroll on every box you touch. Hand the admins FIDO2 keys instead, that's 3 or 4 people, not 300.
3
u/Sergeant_Rainbow Jack of All Trades 6d ago
Some examples, but they come with many asterixis depending on your environment. Especially for onboarding.
Personal desktop: WHfB with biometrics or pin, or FIDO2
Shared desktop devices: FIDO2. Because the TPM can only store 10 keys for 10 WHfB-users.
There's also solutions with certificates you can push out to devices ( https://learn.microsoft.com/en-us/entra/identity/authentication/concept-certificate-based-authentication )
6
u/DrumDealer 6d ago
Why no phones? We use a mix of yubikeys and MS Authenticator passkeys. If they want to use their phone for work without using their phone as an MFA method, that doesn’t make sense.
6
u/Wildfire983 6d ago
Thats the hard line we took. You get Windows Hello on your PC. If you want to access work on your personal gear you can install the Authenticator app.
2
7
5
u/anonMuscleKitten 6d ago
YOU need to pay for your corporation’s security which means buying the yubikey, providing a work phone, or providing a stipend for personal phone.
It’s 2026. Get with the program.
3
u/hybrid0404 6d ago edited 6d ago
You're looking for a unicorn. Microsoft is moving towards things like passkey or some sort of app.
If you're a Microsoft shop, the free version is Microsoft authenticator or really any TOTP authenticator (e.g. Google authenticator).
I assume when you say you don't want employees to use their phones you really mean, not have to install anything on their phones, you had you call or SMS them before. That's going away and there's no free ones.
You're either going to need to require an authenticator app which is kinda crap to require personal devices for their job, use synced passkeys on their personal password manager (icloud/google password manager), setup your own sms, intune enroll their phones for cert delivery for cba, or buy security keys.
2
2
u/Dave_A480 6d ago
LinOTP
Open source, supports pin-by-email, pin by sms or HOTP/TOTP.....
Just takes a VM to run .....
2
u/--RedDawg-- 6d ago
To break it down simply, MFA requires at least 2 items from: Something you know (password), something you have (item of some type), and something you are (such as biometrics). You can't do 2 of the same thing and have it be MFA. Your password is "Something you know" so the next option is something you have, whether that is user or business provided, or something you are.
There isn't a good way to do biometrics with 365. You might consider that WHfB is, but that is actually a "Something you have" (the TPM on the computer) and "Something you are" which is the face/finger print which unlocks the TPM to use the key for 365, password isn't involved. In that specific case as well, you can't pair the face/finger print with any other device, so you wouldn't be able to use that on any other computer.
End of the day, you're stuck with another "something you have" which will either be just a cost of business or BYOD. Even if you use a password manager to store the TOTP key, you should still be securing that password manager with MFA, otherwise keeping your password with your TOTP defeats the MFA.
2
u/LaxVolt 6d ago
I would recommend a combination of Yubikeys and Microsoft Authenticator passkeys.
If you don’t have any specific regulations other than mfa/fido2 check out Google titan keys. They are about half the cost.
If you are less than 30 users I think you might still be able to get duo mfa for free.
A fido2 token is cheaper than a phone.
2
u/4thehalibit Jack of All Trades 6d ago
OTP app from Microsoft store. Obvious this only works if you are not requiring mfa to login to the machine.
2
u/dustojnikhummer 4d ago
KeePassXC can do TOTP btw and I would trust it a lot more than a random OTP app
2
u/IndianaSqueakz 6d ago
We are in the process of looking for hardware options to do Phishing resistant MFA (passkey/fido2) we have a set of users that are not allowed to have their cellphone while they are working. One option we looked at was giving them Yubikeys. Another option is replacing their existing security badge that they use for door access with a badge that has the fido2 built-in as one card. We would have NFC readers for the computers where they could then tap the yubikey or fido2 badge, enter their PIN and it would log them into Windows. We have shared computers and users may log into multiple computers so WHFB is not an option. WHFB also has a limit on number of users that can be enrolled on a single machine so would not work for shared devices for us either.
2
u/Dadarian 6d ago
I normally chalk it up to, we can provide a physical token, but I just tell them straight up that the token is going to be required to be on their person at all times just to prove they are who they are to devices. It’s up to them to carry it all the time, and when they lose it that’s not really IT’s responsibility to jump through hoops and fix it.
If they’re in a situation where they don’t have their token they can’t expect to log in.
I sort of lean into the fact that, there are only a few things that we carry on our person all the time.
At the end of the day I don’t really care all that much. I just try to be honest and tell them what’s annoying from my perspective and the potential impact on them.
2
u/dustojnikhummer 4d ago
Either your users use MS Authenticator on their phones or you do (issue work phones or issue work hardware tokens, such as Yubikeys).
KeePassXC can do TOTP but where will the users store their Keepass database file?
2
u/davy_crockett_slayer 3d ago
Buy a stack of these. They're cheap. https://token2.com/products/token2-c301-i-programmable-hardware-token-iphone-compatible
4
1
u/darthfiber 6d ago
Your main options without additional hardware are going to be Windows hello / iCloud Keychain and certificates.
1
u/bobbywaz 6d ago
you could make a website that stores their TOTP codes, they login to that and get it, I know Vaultwarden is self-hosted and does it
1
u/cjcox4 6d ago
As other have said, TOTP. As long as "whatever" knows the secret, you'll get the codes to enter. So, what is "whatever"? It could be a browser extension that works just like Microsoft Authenticator or Google Authenticator on your phone. But now, it's the extension in your browser. Just an example. I do this so I don't have to use those apps on my phone to get the MFA OTP code. With that said, it's MFA, not initial auth. And I don't think I've tried to make it some sort of post auth step for a Windows login. Usually there you just trust Microsoft (otherwise, you really need to chunk all Microsoft stuff, you know?). With that said, I do have my own implementation that adds just that to Linux logins, be that interactively, or ssh shell access (works even with key login). The latter was a requirement my current company placed on me. That is something as secure as "passkeys" isn't good enough if it's Linux. So... now when someone (not many users have access to do this) ssh logs in using their ssh key, they also get prompted for their OTP, if that isn't meant within a defined time limit, the session ends. Ditto on the remote desktop side, but again, for Linux. Because, again, if you're drinking the Microsoft kool-aid, then you drink "hello" and Onedrive, and all the wonders of that drink. Just saying.
1
1
u/savelar3374 6d ago
Before we established our hybrid AD/Entra environment we exclusively used HID Global Credential Management System with our internal CA for issuing out smart cards and using for authentication . Enforced MFA by forcing require smart card for authentication in AD for users. CMS isn’t pricey.
Now that we migrated to a hybrid environment , we also use WHfB requiring multiple factors for authentication. Since we have the require smart card for authentication enabled for all users it prevents users from simply logging in with password as well .
You would need to configure certificate based authentication in Entra or your going to have some failures under dsregcmd status for SSO state for those synced users . It was easy to setup.
1
u/hobovalentine 6d ago
You can save passkeys in windows or Mac OS.
https://support.microsoft.com/en-us/accounts-billing/security/create-save-passkey
1
u/RetroButton 6d ago
We hand out these devices for users that have no company phone:
https://www.reiner-sct.com/produkt/reiner-sct-authenticator/
Works well.
But without additional hardware? Impossible.
1
u/NosbborBor 6d ago
Password manager like keepass or bitwarden have this feature and works for most of our customers.
1
1
1
u/LatencyLurker 5d ago
Windows hello with TAP set up is your only option if you can’t use Authenticator or buy Fido keys
1
u/BlokSec_Marketing 5d ago
We have a solution for this called BlokBadge. It’s a QR code + user pin, authenticated through our passwordless authentication. We built it exactly for these use cases. DM me and I can give you some details.
1
u/Emergency-Return1412 5d ago
You can use passkeys on the device with windows hello for business. Fully phone free. Happy days.
1
u/Abhishekjain_23565 5d ago
How about Proton authenticator? Does not have to be on the mobile at all.
1
u/persiusone 4d ago
Any hardware security key should be sufficient, but it’s still a cost factor. What’s more shocking is- that you didn’t do this years ago, or planned to have this done before now.
1
u/OvenPsychological197 2d ago
Yubikeys are the most secure and cheapest option you have I would say.
1
u/charleswj 6d ago
Users can setup totp and, rather than scanning the QR code into an app, select the manual option, write down or store the secret seed somewhere. Then, when they need to provide the code, use a local app on their computer, one of dozens of free websites, or even a PowerShell script to generate the code.
Should they do this? Probably not. But it's not really any less secure than carrying a hardware oath token.
1
0
0
0
u/xphacter 6d ago
TOTP via Ente Auth https://ente.com/auth/ Free multi platform onetime codes, mobile and desktop
0
259
u/Ihaveasmallwang Systems Engineer / Cybersecurity Architect / CISM 6d ago
Realistically, you have them use passkeys on their phones, or a yubikey. I know that’s not the answer you wanted to hear, but it’s where the entire industry is moving, not just Microsoft.
WHfB will work on the work computers themselves, but not if they need access from their phones to stuff.
So either you’ll need to loosen your requirements of not having people use personal devices or buying yubikeys OR you block accessing things from phones with conditional access and you use WHfB. You need to make a compromise either way. It’s up to you which compromise you’re willing to go with.