MFA

Microsoft Entra ID External MFA

Microsoft Entra ID External MFA

Microsoft recently announced that External Authentication Methods has been renamed to External MFA and is Generally Available.

Microsoft also announced that Custom Controls is being deprecated, with its deprecation currently planned for September 30th, 2026. Microsoft Entra ID External MFA (formerly External Authentication Methods) replaces Custom Controls.

Here is a brief timeline of Custom Controls and External MFA:

  • September 2018: Custom Controls was released as a Public Preview.
  • March 2020: Microsoft acknowledged some limitations of Custom Control and said that something new was being built to replace it.
  • May 2024: External Authentication Methods was released as a Public Preview to replace Custom Controls.
  • March 2026: External Authentication Methods was renamed External MFA and became Generally Available.
  • September 2026: Custom Controls will be deprecated.

Here’s how to check if you have Custom Controls configured.

Custom Controls Configuration Check

  • Log in to the Microsoft Entra Admin Center.
  • Click on Entra ID > Conditional Access.
  • Click on Custom Controls (Preview).
  • If anything is listed, you are possibly using Custom Controls.

In my example, the Custom Control RequireDuoMfa is currently configured.

If you have Custom Controls configured, you also need to check if the configured Custom Controls are being used by Conditional Access policies.

Conditional Access Policy Check

  • Click on Policies.
  • Click on a Conditional Access policy.

In my example, I will click on the Conditional Access policy named Duo MFA Custom Controls.

…

Read More Read More

Install or Upgrade Duo Authentication for Windows Logon

Install or Upgrade Duo Authentication for Windows Logon

In this post, I will show you how to use my Duo Authentication for Windows Logon PowerShell scripts to check whether Duo Win Logon is installed, install Duo Win Logon, or upgrade Duo Win Logon.

Previously, I wrote the blog post Upgrading Duo Authentication for Windows Logon. That blog post covered how to upgrade Duo Win Logon using the MSI. However, later on, Duo changed Duo Win Logon enough that the application now requires Microsoft Visual C++ 2022 Redistributable, which is not bundled with the MSI installer but is bundled with the EXE installer.

Another limitation of the MSI deployment is that you need to create a transform file to silently install Duo Win Logon. With the EXE installer version of Duo Win Logon, you can specify everything with silent install arguments.

The PowerShell Scripts

Duo-Win-Logon-Checker.ps1

The first PowerShell script checks if Duo Win Logon is installed and reports its version. It is a refactored version of the duo-checker function from the Duo Win Logon MSI upgrade script.

The script uses the Prog-Finder function from the Install Matrix project.

It also tells you if the version of Duo Win Logon is old. For the old version detection to work correctly, you will need to edit the NewVersion variable. You can check for Duo Win Logon releases by reviewing the Duo Win Logon release notes.

Duo-Win-Logon-Install.ps1

This script uses various functions from the Install Matrix project to install Duo Win Logon.

For this script to work, you will need to edit the InstallArgs variable.

…

Read More Read More

Microsoft 365 Passkey Setup

Microsoft 365 Passkey Setup

Microsoft 365 supports hardware security keys with passkeys. Passkeys are sometimes called FIDO2. Passkeys are one of many ways you can secure your accounts.

In this post, I will show you step-by-step how to set up a passkey in Microsoft 365, including configuring a passkey with a break glass emergency access account.

Prerequisites

  • Hardware security key that is FIDO2 compliant. (A common one is YubiKey 5)
  • Microsoft Entra ID Authentication Method for Passkey (FIDO2) and Temporary Access Pass enabled.

The Process

  • Login to Microsoft 365.
  • Click on your account in the top right and click on View account.
  • Click on Security info.
  • Click on Add sign-in method.
  • Select Security key and click Add.
  • Select the type of security key you have.

In this example, I will use a USB device.

  • Plug your security key into your computer and click Next.
  • On the new window select the Security key option to save the passkey to the security key and click Next.
…

Read More Read More

Entra ID External Authentication Methods with Duo

Entra ID External Authentication Methods with Duo

Microsoft recently introduced the public preview of External Authentication Methods in Microsoft Entra ID. I am very excited about External Authentication Methods as they finally allow third-party MFA providers like Cisco Duo to integrate better with Microsoft Entra ID (formerly Microsoft Azure AD).

Microsoft has supported third-party MFA providers for years. The original method for adding external MFA providers is Custom Controls, which was introduced in 2017 as a public preview.

As MFA grew in necessity, the limitations of Custom Controls became apparent. In 2020, Microsoft announced that Custom Controls would not leave public preview but a new solution that addressed its limitations would be created. In May of 2024, the replacement solution External Authentication Methods (EAM) was released as a public preview.

EAM addresses the limitations with Custom Controls, such as satisfying the Multifactor authentication requirement in a conditional access policy rather than using a custom control. EAM is a big deal, as the Entra sign-in logs show Custom Controls as a single-factor authentication when that is not true. I suspect this is because Microsoft has no way of validating whether MFA was completed or not.

Here’s an example of the Entra ID Sign-in logs with Duo using a Custom Control that reports as a Single-factor authentication.

Entra sign-in logs for Duo with custom control grant

If we drill into more details under the Basic info tab, we will still see that the login is reporting as single-factor authentication.

Sign-in log basic info for Duo when using a custom control grant

If we look at the Authentication Details tab, we will see nothing. I suspect this is because Entra has no way of knowing what happened on the Duo side of things, only that Duo said yup this user is good move along.

Sign-in log Authentication Details when Duo uses a custom control grant

If we look at the Conditional Access tab, we finally see that Duo was applied with the custom control and that the result was a success.

Sign-in log conditional access using Duo custom control

The issue of Custom Controls reporting as single-factor authentication in the sign-in logs is resolved with EAM.

Using EAM, we can now directly use third-party MFA solutions like Cisco Duo as an MFA option in Microsoft Entra Authentication methods, allowing us to use the MFA setting in a conditional access policy instead of a custom control. This even allows you to be more granular with the accepted forms of MFA, such as allowing Windows Hello rather than just Duo to grant MFA.

External Authentication Methods is currently in preview. However, everything seems to be working correctly in my testing.

In this post, I will show you step-by-step how to set up Cisco Duo with External Authentication Methods in Microsoft Entra ID.

The Process

Initial Setup

  • Login to the Duo Admin console.
  • Click on Applications > Protect an Application
  • Search for External Authentication Methods and click on Protect beside Microsoft Entra ID: External Authentication Methods.
  • Click on Authorize to spawn the process for Duo to create the needed Enterprise application in your Microsoft 365 tenant.
…

Read More Read More

Cloudflare Access IdP with Entra ID

Cloudflare Access IdP with Entra ID

Cloudflare Access is a wonderful tool that can add MFA (Multi-Factor Authentication) to applications that don’t support it.

I’ve previously covered Setting Up Cloudflare Access using email OTP (One-time PIN). What I didn’t cover in that post was how to set up Cloudflare Access with an IdP (Identity Provider).

In this post, I will show step-by-step how to set up Cloudflare Access to use Microsoft Entra ID (formerly Microsoft Azure Active Directory) as the IdP and use Microsoft 365 SSO (Single sign-on) to make everything very transparent to the user.

Prerequisites

  • DNS for the web application in Cloudflare with Cloudflare Proxy enabled on the DNS record. (or a Cloudflare Tunnel)

The Process

  • Click on Custom Pages.
  • Make a note of your Team domain.

For this example, I will be using the team domain test.cloudflareaccess.com

Microsoft Entra ID Configuration

  • Login to Microsoft Entra admin center.
  • Click on Applications > App registrations.
  • Click on New registration.
  • Name your application. I will use the name Cloudflare Access.
  • Select Accounts in this organizational directory only (Single tenant)
  • Set the Redirect URI platform to Web.
  • Set the Redirect URI to the URL of the Team domain you noted down earlier. Add https:// to the front of it and add /cdn-cgi/access/callback to the end of it.
…

Read More Read More

Upgrading Duo Authentication for Windows Logon

Upgrading Duo Authentication for Windows Logon

Update

The script below still works. However, the MSI installer for Duo Win Logon does not include the new Microsoft Visual C++ 2022 Redistributable dependency. For a safer upgrade, I created a new PowerShell script that uses the EXE installer for Duo Win Logon, which includes the dependency. My new post Install or Upgrade Duo Authentication for Windows Logon contains all the details about the new script.

Duo Authentication for Windows Logon and RDP is great tool that I like to use to add MFA to Windows systems specifically servers, as it could help prevent lateral movement in the network.

When you only have a few systems running Duo Authentication for Windows Logon and RDP upgrading it is short and painless. When you have many systems it can be a bit of a painful process as the only method seems to be to do it manually.

Naturally to solve this I wrote a PowerShell script to do the work.

PowerShell Script

The PowerShell script will check if Duo Authentication for Windows Logon is installed. If no Duo Authentication for Windows Logon install is found it will just exit.

…

Read More Read More

Setting Up Cloudflare Access

Setting Up Cloudflare Access

I’ve been a fan of Cloudflare for a while now. I love how fast they can propagate DNS changes and I typically like to use them as a DNS resolver. An issue that I’ve ran into many times, is how to protect something with MFA (Multi-Factor Authentication) that doesn’t have any support for MFA.

This problem is common with legacy web applications and very common with SCADA (Supervisory Control And Data Acquisition) web applications. The issue I was trying to solve was how to put MFA in front of a SCADA web application.

I decided to use Cloudflare Access. Cloudflare Access goes by a few names some of them are Cloudflare Zero Trust Network Access (ZTNA), Cloudflare Access, and Cloudflare Zero Trust Access. For simplicity I’m going to refer to it as Cloudflare Access.

Cloudflare Access is really nice because you can put it in front of any web application and it will require the user to authenticate before they can even reach the website.

If you have a lot of applications like this you can even set it up so the users can login to a portal to see all of the applications that are available to them. You can do all of this without the user having to install anything. What’s even better is that it’s free for 50 users.

Here’s how I setup a SCADA web app with Cloudflare Access.

…

Read More Read More