[MUSIC]
Libby Brown: Welcome back. In this video, I'm going to
show you how you can take your organization passwordless
with some of our new features that we’re bringing to public
preview. I'm going to demo for you today an admin experience
for how you can manage the credentials that your users
and groups can use to go passwordless. I'm going to show
you the end user experience where your end users will go
and register and manage their passwordless security methods.
And lastly, I'm going to show you how your end user will use
their FIDO2 security keys and Microsoft Authenticator app
in a passwordless login situation. Let’s jump right in.
Coming to public preview in July of 2019 is what we’re
calling our new authentication methods policy page. Here
you can manage the secure credentials such as your FIDO2
security keys and Microsoft Authenticator passwordless sign in.
This allows you to roll these credentials out to your users and
groups in a targeted manner. With our new policies, you have
the ability to enable or disable the credential in your
environment and then choose whether you want to target these
credentials to all the users in your environment or to select
users. In order to choose your selected users and groups, we
have a simple interface to come over here and select who you
want to allow to use FIDO2 security keys.
We also some more settings. You can learn more about these
in our public documentation.
Similarly, we have the same sort of experience for going
passwordless with Microsoft Authenticator. We do call out that
in order for your users to use passwordless with Microsoft
Authenticator, they must already be enabled to use Azure
MFA with push notifications though the Microsoft Authenticator
app. Once that is complete, you can come here to enable
this policy for your tenant and again choose whether you want
to allow all users or a select set of users and groups.
It’s that simple to let your users start to go passwordless with
these two security credentials.
Next, I'm going to show you how easy it is for your end users
to register and create a FIDO2 security key. In order to take
advantage of this, you need to enable your tenant to be a part
of our converged registration experience so that your end
users who are using Azure MFA or self-service password reset,
this is the same portal they would go to to manage their MFA
and SSPR credentials. As a user in the tenant of Wingtip Toys,
I'm going to come here to aka.ms/mysecurityinfo, I'm going to
choose to add a new method. These are all the authentication
credentials I'm allowed to use. I'm going to go ahead and select
security key. I'm going to hit add. This particular key allows
me to either use NFC or USB, I'm going to choose NFC and
walk through a very simple wizard.
That’s the security pin that I've already put on the key.
I'm going to give this a name so I can know that I've registered
it. And if I ever lose it, I know which one to remove. It’s as
simple as that. Now I have a strong passwordless authentication
method tied to this device capable of doing NFC or USB
authentications. Next, let’s show you how you use it in real
life. The first and most likely scenario your user’s going to
encounter using their FIDO2 security keys is simply accessing
their files and content on their Windows device. And it’s as
easy as taking your Azure Active Directory join machine,
choosing sign-in options, choosing security key, and following
the instructions.
And I'm logged in. These FIDO2 security keys are also great in
a shared device scenario. I'm going to walk through the same
exact experience only with a slight detailed difference. Instead of
logging into an account already in the device, I'm going to try
logging in as another user. This would allow a FIDO2 security
key to go to any device, perhaps on a shop floor or in a
retail environment and log into a machine without ever having
logged in before. Again, it’s as simple as using the key and
entering your pin. And then I have seamless single sign on
to all of my apps and resources that take advantage of
Microsoft authentication.
Now as a user, If I'm enabled to use my FIDO2 key to log
into a device using an Azure AD join machine, I can also
use my security keys simply to log into a website and access
my web resources. Again, it’s as easy as choosing a sign-in
option of using a security key. I'm going to enter my pin,
tap my USB key, and there I'm signed in to all my Microsoft
apps and resources.
The last password experience that I want to show to you
today is using Microsoft Authenticator for a passwordless
authentication. Now passwordless with Microsoft Authenticator
might be useful for your users who are highly mobile or
not necessarily always logging into a Windows machine. It’s
as simple as once the user has registered the credential in
their Microsoft Authenticator app, choosing their account,
our system detects that you’ve registered that credential and
sends a notification to the device. The user makes sure that
they can see that number and that they initiated that
authentication. They choose the passwordless credential
or they choose the number, the enter their biometric gesture
or pin, and again, they're authenticated and have access to
all of their web resources. You can use this on a Mac, on an
Android device, on an IOS device, even across Linux, and it’s a
great way to help your users go passwordless on any device
at any time.
I'm proud to show you these demos today. First, our admin
experience will allow you to easily roll out these new
passwordless credentials to your users and groups. Next, we
have our converge registration experience which we believe
provides your users a simple, easy way to create and
manage their passwordless credentials. And lastly, we have
an authentication experience with these credentials that we
hope is fast, easy, secure, and maybe even delightful. These
efforts are a culmination of years of work across an industry
and across Microsoft. So, thank you for watching. We are
so pleased to have you join us on this journey to passwordless.
[MUSIC]