(light upbeat music)
- Up next, a special edition of Microsoft Mechanics.
We're joined today by Microsoft CVP Joy Chik
from the Identity Engineering team
to review the latest authentication updates in Azure AD
that are now generally available
for eliminating the use of passwords
by users and their organizations as well
as more friction-free ways of going passwordless
with the introduction of the new Temporary Access Pass.
So Joy, welcome back into Microsoft Mechanics.
- It is great to be back on the show.
- And thanks so much for joining us today.
So I remember the first time that you were on Mechanics
back in Ignite 2018;
you revealed Microsoft's leadership role
in eliminating the use of passwords
as the main vulnerability
both for security breaches
as well as a primary data target
when the perimeter has been breached.
So, at that time passwordless methods,
such as biometrics and Windows Hello for Business,
they'd been around for a while
and we launched the preview
of the passwordless authentication method
using the Microsoft Authenticator app.
This experience now even works well
on shared devices like Surface Hub.
So a lot's really happened since we started down this path
but how far are you then
in terms of reaching your goal of eliminating passwords?
- I would say we're closer than ever
to our goal of eliminating passwords.
There has been a few stages along this journey.
This includes, developing passwordless methods
then growing the partner ecosystem for devices
and improving the admin experience.
But the good news is that
as of today, everything Azure AD users
need to go passwordless, is now generally available.
So we expect to see much broader adoption moving forward.
And as I will show you today
we are now on the next step of this journey
with the new Temporary Access Pass.
This makes it even easier
to introduce passwordless methods
and it is in public preview today.
- This is one of those things where
I think passwords are just so pervasive.
You're not going to be able to stop people
using them overnight.
- You really can't.
But it's encouraging that over the past year,
with so many of us working remotely,
the use of passwordless methods
has really reached an inflection point.
More than 200 million users
are now using passwordless authentication
across Azure Active Directory
and Microsoft consumer accounts.
So, hopefully it won't be too long
before passwords are a thing of the past.
- You mentioned that Azure AD users
have now the pieces to implement passwordless
and those are all generally available.
What does that mean then in terms of both the user
and the IT side?
- Well, we know that
the easier we make it to stop using passwords
the more users and services can get onboard.
For users, beyond the methods that you mentioned
Azure AD now supports FIDO2 security keys
as an authentication method
for signing into operating systems,
applications, and services.
Organizations can issue these keys
to everyday information workers.
And this approach can make life much easier
for frontline workers using shared devices.
It works by using industrial strength
public private key technology.
The FIDO device securely stores private keys.
Which you can unlock via a biometric or pin.
All authentication messages that are exchanged
are signed by the private key
and then validated by the public key
that's held in Azure AD.
Which then sends a token, or a session cookie,
to the device as a proof of authentication.
- And all of this happens by the way
in just a fraction of a second.
So it feels instantaneous and also convenient to the user.
- Right, and then for IT
we have made it easier to drive passwordless adoption.
This includes how you roll out
passwordless authentication methods in Azure AD.
You can automate the management of passwordless
using PowerShell or our new Microsoft Graph APIs.
We also have new reporting to help you track
how well your organization is doing.
And this really helps as you roll out
new authentication methods
and track their usage over time.
And you can integrate these metrics
with your apps using our APIs.
- Right, I have to really say this is a game changer for me
because I use the Authenticator app
and even though I frequently sign into
lots of different machines and phones and cloud services,
all I have to remember is my email address
and I get a verification from my phone.
So I never need to remember or even type a password.
- Yeah, it's not only easy
but also way more secure than using passwords.
And it's still two factors of authentication.
And when users do not have a phone
or a dedicated Windows 10 device
they can use a FIDO security key.
And in fact, we have worked as part of the FIDO Alliance
to develop a simple common architecture
for secure authentication with FIDO2.
- All right, so let me try this out.
I'm going to start by using this method
to sign into Windows 10.
You can see here
that I already have my profile on the device.
So I'm going to go ahead and insert the USB key.
Then I'm going to click on sign in options.
And I'm going to choose the security key one in the middle
and it's going to ask me to touch the security key.
So I'll go ahead and do that.
And so that's going to use my fingerprint to authenticate.
Now because we're using seamless single sign on
this authentication also carries forward
within my session onto the browser.
So I'm going to go ahead and go to myapps.microsoft.com
and you'll see that it just signs me in.
Now this works with your Microsoft apps,
but you can also see that the SaaS apps
are configured here that are using Azure AD
and Windows-based authentication.
So here you can see, for example, that we have Box.
And I also have my on-prem file share available
and if I wanted to I could click into that
and securely access linked resources
that are on the internet or that are apps on-prem.
- Again, you do not need to enter a password.
It is super secure and is super convenient.
And you can connect to your resources
whether they are on premise in the Microsoft cloud
or in other clouds and services.
- Right, and this also works across devices.
So your pin and biometric by the way
are tied to that USB key
so you can use it to sign into services
with other devices as well.
So for example here,
my machine's set up to dual boot to Linux.
So it's running Chrome,
and in my case
I'll even try signing into myapps.microsoft.com
one more time, this time on Ubuntu
without even needing to type in my email address.
I'll click into the sign in options.
Now it's going to ask whether I want to use a security key
or GitHub in this case.
And again, I'll choose security key.
So I'll go ahead and insert it.
Then I'll use my fingerprint.
Now in my case, you can see that
I have two accounts registered to this key.
So I'm going to go ahead and choose my account.
And similarly, you can see that
I can get to the same resources
that we saw earlier in the browser
that are the apps and anything
that supports Azure AD-based authentication.
- Right, it is fast and it's secure.
And the good news is that we are expanding
the Microsoft Intelligent Security Association ecosystem
of security partners.
And these partners are developing
a growing range of FIDO2 security keys.
This includes a support
for the use of NFC reader devices for passwordless sign-in.
- Right, so you also mentioned the admin updates earlier.
So how easy is it to set all this up for your tenant?
What are some of the changes that have been made?
- So, you enable these experiences in Azure AD portal.
Just go to security settings
then go to authentication methods.
Here, you can see all of our new authentication methods
including Microsoft Authenticator
and the FIDO2 security key.
I will quickly show you how to enable FIDO2 security keys
by clicking in.
You can scope it to all users
or limit the scope to selected users or groups.
And in my case, it is already enabled.
I have already assigned the group FIDO Pilot
and now I will add a new user, Megan Bowen.
If I wanted, I could have broadened the scope
by adding multiple users and groups.
And finally I will hit save.
And now Megan is ready for FIDO2 application.
- Okay, so now that Megan is set up
what has to happen then for the FIDO key
to be associated with her account?
- So Megan would need to register her key.
Here I'm signed in as Megan,
and I have already navigated to aka.ms/mysecurityinfo.
And next I will choose add a method.
And from the dropdown
I will select security key and hit add.
Here, I can choose a USB or NFC device type.
And in my case, I will select USB.
I will make sure my key is ready and then select next.
Then when I continue
Windows 10 will guide me through set up.
So I will hit okay,
and I hit okay again
then tap my key to prove presence.
Now I will set up the six-digit pin
then I'll re-enter it and click okay.
Now I will give it a name,
Feitian USBC, and then hit next, then done.
And that's it.
My key is ready to use.
- Nice, so now you'll be able to use
this to sign into an Azure AD-joined PC,
or like I showed before, you can use it
at the browser level on PC, Mac, or Linux.
And all of these capabilities are now generally available.
But that said, you just released the public preview
of Temporary Access Pass,
so how does this help in terms of going passwordless?
- To be clear, if you already adopted MFA
you have all the pieces in place
to enable passwordless authentication quickly.
With that said, for brand new employees
who do not have a password or MFA
that is where the new Temporary Access Pass comes in.
This is the missing piece that we need to eliminate
the use of passwords as scale.
For example, most organizations have a process
to prove that you are who you say you are.
At the end of the process
an administrator can issue a Temporary Access Pass
to the verified user.
And this Temporary Access Pass is a time-limited passcode
that the user can apply
to register their passwordless sign-in method,
such as a FIDO key or the Microsoft Authenticator app.
So let me show you how you would set this up.
The Temporary Access Pass is configured
as an authentication method.
When I select it
you see the same controls that we saw earlier.
And in this case, I already have it enabled
and I set the scope to all users.
If I click into edit
you will see all the available settings.
I can set the minimum and a maximum lifetime
as well as a default lifetime.
In my case, it's one hour.
And then for the one-time use setting,
we recommend you keep this setting to set no
if you need to use it more than once during that timeframe.
As you can see, it is a very simple process
to get this up and running in your tenant.
- Great, so now this is all set up.
How do you issue then a Temporary Access Pass to a user?
- So, when you need to generate
a Temporary Access Pass in Azure AD
just go to the user you want
and then navigate to authentication methods.
And next, choose add authentication methods
and then select Temporary Access Pass.
You can either keep the default duration,
which is 60 minutes in this case,
or choose a duration that you want.
Then select add
where display the Temporary Access Pass
that you can copy and then send to the user.
And this is just one way to do this.
We also have APIs for this.
So you can integrate this process
into your own solutions.
But Jeremy, we have created one just for you.
Why don't you show us the user experience?
- Okay, so I've received my Temporary Access Pass
and not only can I register a FIDO key directly
as we showed earlier,
but I can also now set up passwordless phone sign in
when I sign in directly to the Microsoft Authenticator app.
Now, first I'm going to go ahead and open up the app.
Then I'll choose add account through authenticator.
And now I'm going to choose a work or school account.
Then sign in, then continue.
And now I'll type my email
jeremy@wingtiptoysonline.com
And then I will be asked to sign in
with the Temporary Access Pass that you just gave me.
So I'm going to go ahead and type that.
As I type, you'll see it's comprised of special characters,
upper and lower case letters.
And I'm going to go ahead and tap sign in
and that will authenticate to the service.
Then I'll hit finish
and now passwordless auth will be working.
So I can then use the Authenticator app to sign in.
- Right, now as a user
you don't need to worry about passwords anymore.
- Okay, so I can see this really simplifying
things for both users and IT.
But given everything that we've shown today
where's the best place then to get started?
- If you have MFA set up
you have what you need to go passwordless today
in just a few steps.
And in fact, if you are a Microsoft 365 admin
you can use an interactive guide
at aka.ms/passwordlesswizard.
With that said, if your organization is not using MFA
you can try the public preview
of Temporary Access Pass
to set up passwordless authentication.
So try passwordless today.
- Thanks so much for joining us today
and also sharing the latest updates
for passwordless authentication.
Of course, be sure to keep watching Microsoft Mechanics
for the latest updates.
Subscribe, if you haven't already
and we'll see you next time.
(upbeat Music)