1. Hybrid Authentication Topologies

  • Password Hash Synchronization (PHS) + Seamless SSO: The recommended baseline for most organizations. Syncs a hashed copy of the on-premises password hash to Entra ID. Keeps sign-in working even if on-premises domain controllers go offline.
  • Pass-Through Authentication (PTA): Validates passwords directly against on-premises Active Directory using lightweight local agents. Used when security policies forbid password hashes from leaving the local network.
  • Federation (e.g., AD FS, Ping, Okta): Entra ID redirects the sign-in request to a third-party Identity Provider (IdP). Most enterprises are migrating away from AD FS to PHS to reduce server maintenance and security risks.

2. MFA & Modern Authentication Methods

  • Centralized Policy Management: Legacy per-user MFA and older SSPR portals are deprecated. All authentication methods are managed centrally under Entra ID > Security > Authentication methods.
  • Method Hierarchy (Weakest to Strongest):
    1. SMS / Voice Call: Easy to intercept via SIM swapping. Discourage use where possible.
    2. Microsoft Authenticator (Push): Requires Number Matching to stop users from accidentally approving spam prompts (MFA fatigue).
    3. Phishing-Resistant MFA: FIDO2 Security Keys (YubiKey) and Windows Hello for Business (WHfB). Required standard for administrative accounts.
  • System-Preferred MFA: Should be enabled as it prompts users with the most secure method they are registered for automatically.

3. Self-Service Password Reset (SSPR)

  • Combined Registration: Users set up both MFA and SSPR in one step at aka.ms/mfasetup.
  • SSPR Setup: Target rollout via Entra ID Security Groups before enabling tenant-wide. Requiring 2 methods to reset a password is the enterprise standard.
  • Password Writeback: In hybrid setups, Password Writeback must be enabled in Entra Connect so cloud resets sync back to on-premises Active Directory.

4. Legacy Authentication Risks

  • What It Is: Older protocols (POP3, IMAP4, Basic SMTP Auth) that cannot use modern OAuth 2.0 prompts and bypass MFA entirely.
  • Remediation: Explicitly block legacy auth using Conditional Access policies.
  • Exceptions: If local devices (e.g., printers, scanners) need SMTP Auth, isolate those specific service accounts and restrict their access by IP address in Conditional Access.

5. The Basics of how User Token Authentication Works

When a user logs into M365, Entra ID uses OpenID Connect (OIDC) and OAuth 2.0 to grant access securely without sending the password to the app itself:

  • 1. User Interactive Sign-In: The user types their credentials into the official Entra ID login page and completes an MFA challenge if required.
  • 2. ID & Access Token Issuance: Upon successful verification, Entra ID issues a short-lived Access Token (typically valid for 1 hour) and an ID Token containing user profile details.
  • 3. Token Presentation: The user’s client app (e.g., Teams, Outlook Web) presents the Access Token to the backend API (e.g., Exchange Online, Graph API) to access resources.
  • 4. Silent Refresh (Refresh Token): Entra ID also issues a long-lived Refresh Token. When the Access Token expires, the app uses the Refresh Token behind the scenes to request a new Access Token without prompting the user to log in again.
  • 5. Continuous Access Evaluation (CAE): Entra ID actively monitors security events. If a password is reset or a critical risk event occurs, CAE revokes the Refresh Token immediately rather than waiting for the Access Token to expire.

6. Sign-in Logs & Common Error Codes

  • Log Types:
    • Interactive: The user explicitly entered credentials or responded to an MFA prompt.
    • Non-Interactive: A client application refreshed an access token automatically in the background.
  • Key Error Codes:
    • 50126: Invalid username or password (often an un-synced password change or PTA agent issue).
    • 500121: User failed or canceled the MFA prompt.
    • 50074: Strong authentication (MFA) was required by Conditional Access, but the user did not complete it.

7. Essential PowerShell Cmdlets (Microsoft Graph)

  • Connection Scopes:
    • Connect-MgGraph -Scopes "UserAuthenticationMethod.ReadWrite.All", "AuditLog.Read.All"
  • Manage User Auth Methods:
    • Get-MgUserAuthenticationMethod -UserId user@domain.com (List registered MFA methods)
    • New-MgUserAuthenticationPhoneMethod -UserId user@domain.com -phoneType "mobile" -phoneNumber "+1 5555555555" (Pre-populate user phone number)
  • Troubleshooting Password Sync:
    • Get-MgUser -UserId user@domain.com -Property LastPasswordChangeDateTime (Verify cloud timestamp for last password change)