in this video we set up multi-factor authentication for windows virtual desktop
hello everyone i'm travis and this is Ciraltos in this video we're going over
setting up multi-factor authentication or mfa
for windows virtual desktop users with a conditional access policy
before that please like subscribe and share and click the bell icon to get
notifications of new content username and passwords have been a part
of computing ever since i can remember but that alone is not considered by many
sufficient to secure an environment usernames are easily guessed
and passwords can become compromised multi-factor authentication adds another
wealth factor to the verification process
azure ad has an integrated mfa platform that can work with a phone
sms or an authenticator application available for
ios and android devices adding an additional factor to user logins
enhances the security posture of an organization
we use a conditional access policy to enable mfa in this video
a conditional access policy is an if this than that style rule
built into azure ad for enforcing or blocking
logins under specific conditions let's start with the requirements
azure 80 premium p1 or p2 is required to enable conditional access policies
if you don't have azure 80 premium you can still use
mfa by enabling the azure ad security defaults on the tenant
this enables a default set of policies that apply to the tenant
one of those will require mfa for all users security defaults
is a good alternative and if you don't have azure 80 premium it's recommended
to enable it matter of fact newly deployed tenants
have this enabled by default security defaults enables other settings
such as blocking legacy authentication it enables mfa for all users there's no
way to modify the security defaults more granular control for security
settings requires azure 80 premium p1 or p2
next let's talk about the windows virtual desktop login process
the windows virtual desktop service is an azure pass service
initial authentication takes place with azure ad
this is where we apply the mfa conditional access policy
once the user logs into the windows virtual desktop service
then they have to authenticate to the session hosts
this is the case for both published apps and desktops
the second authentication is an active directory domain services login
either windows ad or azure ad domain services
we are not applying mfa at this point these session hosts are not exposed
directly to the internet and only available after the users log
in to the windows virtual desktop service
coming up we're going to target a group of users for mfa this is the same user
group assigned to accessing windows virtual desktop
by using the same user group we can ensure that mfa
conditional access policy is applied consistently to all users
the goal of the demo coming up is to create a policy that enforces
mfa for users outside of the office at a high level the policy will be enforced
on the windows virtual desktop user group when they are accessing windows
virtual desktop if they're coming from a non-trusted
network with the web or the desktop client mfa will be
required and they'll have to re-authenticate
every hour after they first sign in let's get started in the portal to walk
through setting up our conditional access policy
let's start by adding our trusted ips this is one or more
known safe public ip address your users will be coming from
when a user signs in from this location they will not get the mfa prompt
from the azure portal go to azure ad
security and named locations there's a link at
the top that'll take you to the location to modify
mfa trusted ip addresses click the link under trusted ips
add any ip addresses or ip ranges of known
safe locations most common this would be the public ip address
your office users come from when accessing the internet
if you don't know what that is simply hop over to the computer on that network
open the web browser and there's a few sites for this but
if you go to ipchicken.com
that will tell you what your public ip address is
so i'll copy this
i'll paste that in and put a slash 32 at the end the slash 32
is a subnet range of a single ip address if you have a larger subnet you can add
a different subnet mask to cover all the ip addresses
i suggest avoiding dynamically assigned ip addresses
if a consumer grade internet connection is in use
also if an organization offers public wi-fi that should be on its own public
ip and not included in this list click save
when finished we'll close and close the window next go
to all services and search for conditional access
there it is azure 80 conditional access
create a new policy start by giving it a name
i'll use wvdmfa for this example
next go to assignments assignments are where you assign the policy
we'll use the same group used to assign rights to log
into windows virtual desktop alternatively you could select all users
that way there's no chance someone may get access to windows virtual desktop
that are not a member of the group for mfa say for example
user gets directly assigned to an application group and is not part of the
wvd user group this conditional access policy would not
apply to them and they would not have mfa enforced if
you do select all users you can add users to exclude
for this example we'll select a user group
add a user or group and search for your group in my example wvd users
click select now the rule will apply to all the users in that group
move on to cloud apps or actions
here we go to select apps and search for windows virtual desktop
there's a couple that are returned windows virtual desktop windows virtual
desktop ame and windows virtual desktop client we
only want the windows virtual desktop selected
it starts with 9 cd so we'll select that and select
now let's move on to conditions go to locations and set the configure to
yes leave include as default and go to
exclude we're going to exclude a location from
the mfa policy so select to pick a location and here it
shows the mfa trusted ips that includes the ip addresses we added
to the mfa trusted site ips click and select with this setting
anyone coming from a trusted ip will be excluded from the condition so
the mfa policy will not apply for users coming in from the trusted ip
the idea is if somebody's logging in from their office
they probably don't need mfa applied next go to client apps set configure to
yes under the client apps's policy will
apply to leave browser and mobile apps and
desktop client checked uncheck exchange activesync client and
other clients
this will set the condition to apply if the user logs in
with the web browser or the client application coming from any ip address
except the ones we excluded click done next under access controls go to grant
set this to require multi-factor authentication
this will grant users access once they fulfill the requirement of multi-factor
authentication click select then go to session
from here you can set a reauthentication window the microsoft default is
every 90 days to force reauthentication 90 days may seem a bit long between
reauthentication but things like password changes account
settings getting disabled or any other changes in the user
security posture will trigger a re-authentication set
this to a more frequent sign and if needed
for this example i'll set it to once every hour
select sign in frequency change the value to 1
and the unit to hours and select now we need to enable the policy at the
bottom of this page there's an option for report only
or turn the policy on or off leaving it to report only
runs it in audit mode so we can see what happens if the policy
is enabled for now let's turn it on and click create
now that it's enabled let's test i'm going to open up a new incognito window
and i'll go to windows virtual desktop this computer is not coming from a
mfa trusted network
log in with a user who's a member of the group we assign the conditional access
policy to
it asks me for more information we'll click next
this wizard will walk the user through setting up the microsoft authenticator
app for multi-factor authentication we'll click next to set up the account
open up the authenticator app add a worker school account
and scan the qr code once done click next it'll send a test
and next and done
i'll click no to stay signed in now that user account is onboarded to
windows virtual desktop and mfa is enabled next let's try
connecting with the windows remote desktop client open the remote desktop
client and click subscribe with url
either enter in the workspace url or if you have email feed discovery setup
enter in the user's email address click next
and here i'll go through the same sign-in process
there we go i've got an approval request in the authenticator app
i'll approve and i'll uncheck these for now for the demo
there we are we've logged in with the web client and the desktop client
enforcing mfa one last thing i want to test
let's go over to the machine with the public ip address we added into the
mfa trusted ip list from here i'll open up the web client
i'll log in with the same user account
i'll click no so i don't stay logged in on this screen
because i'm accessing windows virtual desktop from a machine behind
the public ip address we added to the mfa trusted site ip list
i'm not getting prompted for mfa that's how you set up mfa
for windows virtual desktop users thanks for joining me i hope you found
this useful don't forget to like subscribe and click the bell icons for
notifications of new content thanks for watching