18 ms·

The Microsoft MFA system almost brought me to a nervous breakdown

• CottonMcKnight 5y ago
  That reminds me of an issue I've had with Twitter for seemingly forever: It is impossible to reset the password on an account if only the email address or phone number is known, and not the username. In my case, the account was created years ago, and I have since lost both the username and password.
• CTOSian 5y ago
  local whorehouse is more organised than M$
• danlugo92 5y ago
  Not your keys not your account.
• hpcjoe 5y ago
  Probably not what you want to hear, but ... I'd recommend migrating all your important data and code out of that system ASAP. Make (at longest) monthly backups of your code/data, and keep them locally. I know, this can be impracticable for those with huge infras/data collections. That is, until you assess the risk that with these types of systems, you can, and will, lose access to everything, on a moments notice. With absolutely no help from the vendor. They really don't care. They rarely put a human in the loop to help solve your issue, as it costs them too much, for the value that provides them. Not you. That is, they don't care about small customer retention. Unless you are writing 1M USD/month or more, you likely don't even have a human you can reach to help you resolve issues. Every {S,P,I}aaS account you have is a risk surface. If these accounts suddenly went away, what would be the impact upon you?
• tanseydavid 5y ago
  The emperor is not wearing any clothes. MS authentication is a bizarre and confusing experience and has gotten worse not better over time.
• simonblack 5y ago
  MSFT insists on making itself irrelevant. Most people are sick of the jumping-through-hoops circus act that MSFT makes users do. But many of them are absolutely too dumb to 'just walk away'.Tell them about all these shenanigans and they'll insist that "It's not a bug, it's a feature".
• kgizdov 5y ago
  "The efficiency of Microsoft. Or how the Microsoft MFA system almost brought me to a complete nervous breakdown in under 24 hours." by me. I hope this bug gets fixed sooner rather than later.
• bombcar 5y ago
  The more complicated these setups get the more dangerous it is to stray from the basic default path. Nothing else is tested.
• Shared404 5y ago
  And remember, there's no way to use Windows 11 home without having a MS account. I'm sure this will end well.
  • matheusmoreira 5y ago
    Hopefully it will end with more people switching to Linux.
    • deleted 5y ago
      [deleted]
    • userbinator 5y ago
      In reality, it will probably just end up with more people staying on Windows 10.
      • C19is20 5y ago
        Back to 7.
      • rnotaro 5y ago
        In reality, the non-tech population don't really care about that issue.
        • mywittyname 5y ago
          Yeah they do. We just don't hear their complaints about not wanting to create a fucking Microsoft account because they just cave and make the account. Few people want a microsoft account, which is why they force you to get one. Apple gets this right. You can have a local account on your machine separate from your iCloud account.
      • gruez 5y ago
        Unless desktop linux makes huge strides that'll most likely be the case. The current LTSC is good until 2029, and it's rumored that the next LTSC won't be based on windows 11 but will be supported until 2031. Hopefully that's enough time for microsoft to get their shit together, or at least for linux desktop to make inroads.
• post_break 5y ago
  I have had panic attacks due to office 365 becoming unlicensed on an RDP server in use. Friday I finally was able to turn off password expiration and get it to properly license. Every year it renews has been full of stress and issues since we buy through a partner program. Nothing like having the scariest issue at our company be a fucking license issue for a product we pay money for every year.
• cosmotic 5y ago
  The numerous 500 server error screens are a bug smoking gun.
• jacquesm 5y ago
  What surprises me more than the fact that these systems are buggy and can put you in impossible situations is that people continue to accept them. Because no matter how dire things get as soon as it works again it's all forgiven and forgotten until the next near (hopefully) disaster strikes.
  • hnzix 5y ago
    Because Microsoft is too big to fail. When implementing MFA for BigCorps, their internal infra teams often only know MS products and refuse to accept that there could be a better alternative (even when 100% compatible with their stack). It's the ultimate vendor lock-in.
    • easton 5y ago
      No, it’s because it’s free with Exchange, and also because this can’t happen (even if you screw up and lose access to all of your global administrator accounts somehow, you can contact Microsoft and prove you own the domain name to get back in).
      • hnzix 5y ago
        IIRC it's not free for a wider identity deployment, it has incremental pricing that makes it look free. It works out somewhat cheaper than a third party solution.
    • bsder 5y ago
      Setting up and running MFA for your business SUCKS. Microsoft is simply least shitty. Google has their own failure modes. I'm open to hearing who is better that won't cost me an arm and a leg.
  • exolymph 5y ago
    By the very nature of edge cases, most people don't experience them (in a given domain like "interacting with Microsoft products"). That said, this setup sounds broken af, maybe it's all so much worse than I realize...
• xkbarkar 5y ago
  Apart from being interesting it was a really fun read.
• neatze 5y ago
  I don't understand what happened with MS support at all.
  • saltminer 5y ago
    What happened is that MS support has a script they are not allowed to deviate from, and, in their infinite wisdom, it was never considered that their support scripts could be incomplete, that things like this could happen. Back when I did IT, occasionally changing someone's name would work for everything but Office 365. Only, Office 365 would appear to have the correct name everywhere that we could see, and that MS support could see, but sign into Office on a fresh Windows install to activate it and the wrong name pops up every single time. Some system failed to update somewhere inside the underbelly of MS, which their support cannot acknowledge as a possibility - it must be one of our systems (though they never say what exactly, since then we could disprove their claims). The only workaround we found was to change the affected users' accounts to something else, wait a couple days, then change it to the correct name, and it usually worked. Keyword: usually. Sometimes you had to repeat the process before whatever mystery system MS runs got fixed. All the while, their support would staunchly deny that this could ever be a problem with their systems. Not a "we'll look into it" form response, even, just a very toned-down version of "you're lying, it's all your fault, fuck off." The best part is that they know that there's no way we could just stop using Office (or Windows, for that matter), so there's no incentive for them to fix these things. Instead, they can just have support give us the run around claiming their products are perfect.
  • resonious 5y ago
    This seems to happen with all of the big companies. Their customer-base is so unbelievably huge that even if you are a paying customer they just can't help you.
• anm89 5y ago
  There is something about Microsoft specifically where they are just willing to leave absolutely broken systems in production and just refuse to acknowledge it or care in the slightest. Each of the FAANG members seems to have their own signature failure mode and this is theirs, whereas it seems like apple google are more likely to make working software and then just block you out of it because they don't care. While I don't find Microsoft to be the most unlikable they do seem to be by a long margin the least competent.
  • danlugo92 5y ago
    As long as people keep giving them money this will keep going on.
  • lazide 5y ago
    I see you have no Oracle products on your critical path? If so, you would think Microsoft was only middle of the road this way.
    • aksss 5y ago
      Right? These comments also make me think there are no Adobe customers here.
  • jiggawatts 5y ago
    In the middle of a pandemic with many people working from home, Microsoft flat refuses to acknowledge that all of their VPN products have throughputs limited to about 10-50 Mbps. This includes not just DirectAccess and AlwaysOn VPN, but also their Azure VPN stack as well. I've never seen any MS VPN protocol crack 100 Mbps, even when using 1 Gbps fibre connections on both ends. We have customers getting ~1.5 Mbps effective in typical scenarios. There are thousands of forum posts about this, with many referencing support tickets, etc... The response from Microsoft is radio silence.
  • moepstar 5y ago
    >>>they are just willing to leave absolutely broken systems in production and just refuse to acknowledge it or care in the slightest. I mean, why would they care? At the rate companies are buying into their eco-system, willingly making them dependant for ages... What would happen if they fix all their crap, getting their act together? Most probably: nothing - since all their broken-ness can't seem to slow down adoption, why would fixing it increase it?
• anm89 5y ago
  There is something about Microsoft specifically where they are just willing to leave absolutely broken systems in production and just refuse to acknowledge it or care in the slightest. Each of the FAANG members seems to have their own signature failure mode and while I don't find Microsoft to be the most unlikable they do seem to be by a wide margin the least competent.
  • abraxas 5y ago
    If you don't find reasons to dislike them, I and many others can tell you a few stories from the nineties that will change that.
    • boppo1 5y ago
      Please share. I'm in my 20s and vaguely remember hate for MS when I was a kid on PC gaming forums. Now though, Google and FB are the evil ones everyone talks about.
      • abraxas 5y ago
        First they fucked over Netscape to the point where they went out of business by messing with Win32 APIs to the point of making it unusable. Then pimped and pushed Internet Explorer down everyone's throats. Then they tried to embrace and extended THE WHOLE INTERNET with their proprietary ActiveX components. We literally came within an inch of having the internet controlled by a single company.
  • dghlsakjg 5y ago
    They really put the M in FAANG!
    • gruez 5y ago
      Well there's another acronym that includes them. Unfortunately it's rather vulgar so I'll list out the letters in alphabetical order: AAFGMN.
• smoldesu 5y ago
  My Microsoft account was hacked 2 years ago, and after spending 3 days with support trying to get my account back, I finally bit the bullet and switched to Linux. Being able to just make an account on my computer without being connected to the internet felt like I was transported to some fantasy realm. What's that, the software store lets me download things without an account? Feels like Cloud 9 to me.
• jacknews 5y ago
  It's not only MFA, the whole authentication system is broken. And then small details like your skype password is now your microsoft password, so if you forget/change skype password on a separate linux machine or whatever ... My kids learnt some new words when I had to setup microsoft accounts and family account or whatever it's called so I could buy minecraft bedrock edition for them to play with their friends (in addition to the java versions I already paid for).
  • themodelplumber 5y ago
    Similar here. The process made me want to donate to the Minetest team because every last one of our worlds is still available and lan parties are still fun. Same with Super TuxCart, so easy to get going.
  • abraxas 5y ago
    Microsoft makes little children cry. In the endless stream of fuckups with their account management they managed to delete all of the Minecraft worlds my son had built. This was two years ago. He was 8 at the time. His passion for Minecraft has significantly waned after that. Microsoft is the same shitty, incompetent, abusive, predatory company that I remember from the nineties and will likely never change.
    • WolfRazu 5y ago
      Was this realms? I thought Minecraft worlds were stored locally.
      • abraxas 5y ago
        Yes, but it got wrapped around an axle where he could neither log in nor in any way move his worlds to a different device. Their advice was to uninstall Minecraft and in the process lose all local data. No migration path was offered. And it all started when they started demanding that he logs in with a Microsoft account.
  • farmerstan 5y ago
• fareesh 5y ago
  Question for folks who work at large technology companies: In the peasant world, some of us use various combinations of software to go through our logs and monitor errors - 500 and others, as part of our day-to-day. There are products built around this like rollbar, sentry, logrocket etc. Typically we'd encounter these routinely and fix them, or reach out to the users independently if we're unsure of the specific use-case that's leading to the crash. How does this kind of thing work at large corporations? I imagine there are hundreds of different web applications, and there's a separate devops team, possibly for each of them. How do the developers in places like FAANG, Microsoft, etc. stay notified about these kinds of crashes? What is the average volume of 500/internal server errors at scale? Is it considered normal to have hundreds/thousands of these a day, thereby creating a needle in a haystack kind of problem?
  • munchbunny 5y ago
    Speaking for my own experience, the sheer scale means that there are always errors in varying amounts and you are just dealing with the most important ones at any given time. Running with your needle in a haystack analogy: you will not go looking for a needle in a haystack, nor will that needle be relevant, if right next to it you have a whole bale of needles. And you often do.
  • lnanek2 5y ago
    Not even just that. Often we engineers know about the issues, but they are so rare the PMs aren't willing to let us work on them. PMs get bonuses for shipping features, not letting their engineers do KLO work and keep all the rare edge cases functioning. My team once had a bug on a client app that caused the phone to vibrate randomly, and the PM still wanted us to spend a week to rewrite an Android demo to iOS so he could look better for a presentation to the CEO next week instead of fix it. Sometimes the release team will put their foot down on a really bad error rate and force a team to fix it or not get into the next release. You pretty much need hundreds of crashes an hour for that, though. One guy paranoid about people trying to login with his phone number and flipping a weird option would just get set to priority normal, backlog status in the issue tracker and never looked at.
  • Kilenaitor 5y ago
• inetknght 5y ago
  Microsoft's multi-factor authentication system is 100% broken. I'll just leave my anecdote that I mentioned on a previous occasion [0]: https://news.ycombinator.com/item?id=27447820 https://news.ycombinator.com/item?id=27447820 > I lost my Microsoft account years ago. I still get emails from Microsoft stating that there's suspicious activity on the account. I got two just yesterday. > Despite that, despite still having access to the email the account is on, I cannot recover the Microsoft account. Despite Microsoft notifying me that the account is still, years later to this day, being abused, cannot use any form of recovery. I cannot access the account with help from support or even after visiting a brick-and-mortar store. > It's one big reason that I've long since refused to purchase anything more from Microsoft and have ditched Windows. Funny enough, after reading the article's tl;dr it sounds exactly like what might have happened to my account: > TL, DR: If you have MFA enabled on your Microsoft account, this automatically adds your phone number as a sign-in alias, supplementing an attack surface to your account. Attempting to remedy this issue by limiting your phone number to only be used during MFA removes your phone number from the MFA backend instead while leaving it on your account. That prevents MFA from working altogether, but it does not disable it for the account. Thus, leaving your account completely inaccessible forever. Microsoft support will then blame their bug on you, the user, and refuse to acknowledge the issue clinging to an internal policy set up entirely incorrectly. If you think account recovery, MFA setup, password reset or account reinstatement forms will work, you would be wrong. All of these rely on the same system that has been allowed to enter an unsupported state and cannot recover independently.
• discardedrefuse 5y ago
  So this freaked me out! A week ago I went passwordless with my Microsoft account; which required setting up Microsoft Authenticator. While I was there, I re-evaluated my entire MFA setup: * I had already setup Authy OTP codes, which I was actively using. So I left that alone. * I had already setup an external email. So I left that alone. * I setup Microsoft Authenticator for the first time. * I added a pair of FIDO U2F YubiKeys. * I generated and backed up an account recovery code. * I REMOVED my cell phone number because SMS is not secure. * I did NOT look at my aliases because I wasn't aware that was even a thing. It's not part of the Security Dashboard. Here's what worked: I've been able to sign in with Microsoft Authenticator on my phone, the YubiKeys on supported browsers, and receive codes at my external email if neither of aforementioned devices are available. I have noticed that, even though the Authy OTP code is still listed on my Security Dashboard, I can't trigger a prompt for that code. This isn't a huge deal, since both Authy and Microsoft Authenticator are on my phone. In reaction to your post, I went and checked out my aliases. My phone number was NOT in there. The only alias I have is my primary Microsoft email. I don't know if my phone number ever was in there. Perhaps it was, and when I deleted my number from the Security Dashboard it also deleted from the aliases? I don't know. I do know that there is no phone number listed under my Account Info or Security Dashboard. Thanks for this post. It reminds me just how vested we are on certain accounts; accounts that can disappear in an instant. I hope you get your issues resolved!
  • temp8964 5y ago
    I know SMS is not 100% secure, but you can easily get SMS recovered if you lose your phone. How do you cover Authenticator if you lose your phone? I always keep both.
    • discardedrefuse 5y ago
      Microsoft Authenticator and Authy both backup to the cloud. I also have a non-Microsoft email linked to receive 2FA codes, as well as 2 hardware security keys, and an account recovery code. I think I'm covered.
    • bmitc 5y ago
• cupcake-unicorn 5y ago
  Microsoft products and the office suite are like Stockholm syndrome now. I never hear any good reasons for companies actually using them and it's always just breaking or in fear of being broken. It is so shocking to me how bad it is at this point or what value companies are actually getting at the end of the day when they're paying for something this broken and unusable.
  • nvr219 5y ago
    That's really weird because I constantly hear about how great Excel (especially compared to gsheets) and OneNote are (on Windows anyway). Outlook has its lovers and haters though.
    • toast0 5y ago
      Google sheets is clearly terrible, but Excel's competition is older versions of Excel (and maybe Apache/Libre/OpenOffice.org(tm)). How many people are excited to upgrade to the latest Excel? Or do they dread to find how Microsoft has messed it up some more.
      • nvr219 5y ago
        Good point.
  • jodrellblank 5y ago
    There is value in being in an Excel spreadsheet, sending a link to someone on Teams, everyone in the channel opens it and you're all collaboratively live-editing the same spreadsheet, some using desktop Excel and some using web Excel, and you add a comment to a cell and @coworker in it, and something inside Office Cloud emails them a notification. Quietly, Microsoft have turned a world where EditPad was a hot new thing, to a world where a few people could open the same OneNote notebook if it was on a local fileshare, to a world where Office365 is all of your company sitting inside a collaborative cloud-based Microsoft Office environment where everything is connected to everything and you can embed any kind of Office program into Teams channels, access all of them over the web, notify coworkers through the Graph, sync files through OneDrive, search accross all your employer's data with AD based permissions, and do similar with other companies using Microsoft tools, and it's all pluggable with things from Adobe and Trello and whomever, and you hardly have to set anything up for it, no web servers, no database schemas, no daemons, etc. And it's completely passed the Linux world by. Head-in-the-sand "nothing has changed in computing in decades I can edit text files any way I like" obliviousness that there's any other world out there. Teams is horrible software, sluggish, buggy, RAM hungry, and yet it could be the greatest strategic success of Microsoft for the 2020-2030 decade. Much more impactful than Windows 11 or Windows Server 2022. It's more immediate than Outlook email, simpler than any VoIP phone system, easier to search than any network fileshare, simpler to setup than Exchange, and yeah you're doing the "no wifi less space than a Nomad, lame" response because "chat programs existed before", and you're wrong to do that, it's more easily remotely usable than any VPN client, pluggable, connectable, bot-scriptable - and right there in every company that uses Office365 unlike (Slack, Discord, Zoom, et al). It's what they tried for with Skype and Lync and LiveMesh and SharePoint 2007 all merged together and they've done it this time and that should make you pay attention. Any ordinary employee who can use Microsoft stuff can use it, it doesn't need an Org Mode tutorial or a `git init` or an email from IT telling you which server address to put in which settings dialog, or a signoff to buy from yet another SaaS vendor. Outlook will let you make a new Teams meeting from the same place you make a new email. When you write the recipient's emails in the To field, LinkedIn profiles appear for the names you hover over. There were no Zoom plugins, no LinkedIn plugins to install. I don't like it, business people love it. Office quietly gained the ability to search text in pictures, and handwriting. And it is cheap with a lower case c, Office, all of it, desktop and web, and cloud file store, and integrated services, for the price you might pay for a Zoom or a Dropbox or a 3rd party single-purpose cloud service license. It's not exciting, it's not going to convince anyone who hates Microsoft to switch, it's not great quality software, but Microsoft have not been resting on their laurels; they have been cementing their place in the heart of business IT, putting down roots, and building things people want. It used to be the case that if you wanted Microsoft Excel, other things were polished but nothing else was quite the same. Now it's more likely the case that if you buy from a competitor you get a pile of janky sluggish cloud awfulness just the same, but from another vendor and it's more expensive and less interoperable. Now to make a good all-purpose Excel competitor it needs Windows and Mac and iOS and Web versions and cloud file storage service and good integration and start from $0 for personal use. "Microsoft doesn't know what they're doing" is not the right response.
• FirstLvR 5y ago
  thanks for your post! as result i backup (one more time) my recovery keys in a encrypted file somewhere on my 3-2-1 backup storage arch technology is good but man, this is getting too convoluted
• 14 5y ago
  Lived this experience with my hotmail account. Will never forgive you MS and will never give you another account.
• ufmace 5y ago
  Funny, I just posted on another thread a few days ago how kind of the same thing happened with an old Yahoo account I don't use much. I know the username and password, yet it's impossible to log in. For a while, every time I tried to log in, it tried to make me do something different for 2FA, which I don't want on that account. I refuse to supply a phone number or other email. I think I installed a Yahoo phone app at some point. Then one time, it basically started refusing to do anything, just gave me several options that don't work. I just tried again a few days ago, basically for laughs, and now it won't even let me enter a password at all. I guess that account is just forever inaccessible. Good thing there wasn't anything important on it. Now I'm kind of afraid to do anything with my Microsoft account on the web. I've never used Microsoft anything on the web, and don't particularly care to, but it seems to be required to have an account to run a Windows computer, so I guess I have one, under my gmail address.
  • deleted 5y ago
    [deleted]
• upwardbound 5y ago
  Sorry to hear about this shitty experience. I have a friend who works at MS so I sent them this article and hopefully they might be able to get it properly looked at. Thanks for all the debugging you did and sorry about what you went through.
• deleted 5y ago
  [deleted]
• msravi 5y ago
  Everything about Microsoft cloud and its ecosystem is broken. I recently signed up for onedrive (microsoft business basic, actually), and I didn't even know which domain to navigate to. They have a gazillion different URLs, and each of them is different from the other. Here's a (partial!) list: azure.com onedrive.live.com admin.microsoft.com microsoftonline.com office.com office365.com onedrive.com onmicrosoft.com sharepoint.com windowsazure.com Each one of those portals take you to SOME view of your account with a gazillion settings. Many of them are repeated, and changing it on one portal doesn't necessarily reflect in others. For example, I enabled 2FA somewhere (and it worked), but going to admin.microsoft.com showed 2FA disabled. Even payments, which every other website seems to have figured out, is broken. There was a recent change in regulations in India for subscriptions on credit cards that allow the customer to control the period of subscription, enabling/disabling, etc. Microsoft of course, hasn't implemented the changes (despite the regulations being notified in August 2019), and because of that, transactions are being declined. So can I go and make that payment online? Well, no. Your subscription shows up as "expired" because it couldn't charge your account, and the only option it gives is for you to "reactivate" the account. Great, so I'll just reactivate. But no, it doesn't allow you to pay when you reactivate - it's going to try and charge your credit card again, itself, as a subscription, sometime. And of course, that's going to fail again. Loop! Addendum: So somehow, with the help of Microsoft support, I manage to sign-up for another subscription with the same licenses for the same cost, and they disable the old one. Great. So this time, it tries to charge my card, fails, but then allows me to "settle" the "overdue" amount manually. I do that, and my account is "active" again! Do they send me a mail saying they've received the amount? Nope. Does my Microsoft account billing page show that I've made any payment to Microsoft? Nope. The only indication that I've made a payment is that my account is active with an expiration date in the future.
  • aksss 5y ago
    Domains: Respectfully, you don't need to know all the permutations, just the ones that get you what you need. Office.com is an easy one to remember, from which you can get to everything else. Who cares about the redirects? If you're trying to default deny new outbound connections and build an allow-list for MS resources, you'll have your work cut out for you though. They have a downloadable cross-reference of subnet/service/apps somewhere that seems about 85-90% accurate at any given time. MFA enable/disable: there are multiple places and methods to enforce MFA for users in a Microsoft tenant. So yeah, it can be disabled in one place, and enforced in another place. For example, conditional access policies may require it while the older deprecated interface for enforcing MFA may show it as disabled. For better or worse, this is common to many topics in Microsoft-land, a combination of there being three different ways to accomplish the same thing (which is probably most often a feature, honestly), and the relatively rapid pace of change (a double-edged sword) that deprecates terminology, branding, and tooling frequently. It does require you to actively work to stay informed about how the platform evolves over about a 18-24mo period. Payment History/Billing: It honestly does benefit most business customers to work through a Microsoft partner rather than a direct relationship, oddly enough. A partner will often have far more flexible license commitment terms, more flexible payment methods, occasionally have better pricing, and always have better invoicing and reporting capabilities than are offered in direct relationships. Microsoft's cryptic payment history and invoice reporting is pretty offensive - it works great as long as you never have any questions. All that said, direct relationships are for customers that just need the basic services without any special requirements; partner relationships are for businesses that have more mature requirements but don't want to be experts on the rabbit hole that is Microsoft-land. Many SMB Microsoft customers attempt to go it alone thinking it's easy (in no small part due to MS marketing) but the minute a business wants to get more than ankle-deep in any technical domain such as endpoint management, data loss prevention, compliance management, threat management, etc., they will quickly find themselves underwater - not because it's complex (it's all easy) but because it requires a lot of deep-quirk knowledge and ongoing maintenance and monitoring. This isn't necessarily particular to Microsoft, though I think a lot of marketing has gone into creating the impression that IT can be 'easy'. But just like a IDS/IPS, buying the tool is the easiest step - it's the care and feeding that really saps your labor force and makes most solutions fail. Policies need to stay relevant, state need to be monitored, deviation needs to be remediated, changes need to be incorporated. It (IT) takes constant work to do it right.
• iudqnolq 5y ago
  I have the cheapest Microsoft small business plan (forgotten what they renamed it to this time). I tried out a free trial of the next plan up. When that expired it didn't downgrade to the previous plan, and I found out while debugging why my email had turned into /dev/null.
• jiggawatts 5y ago
  I can understand if a product has limitations, or odd edge cases, but Microsoft MFA is purposefully designed to be user-hostile. Some examples that came up recently in "not corner case" scenarios: 1) For tenant-to-tenant guest access, each user must re-register MFA for each tenant they've been invited to. So if you already have the Authenticator app installed and configured, it doesn't matter. It'll prompt you to create a new entry each time. I have dozens already and clocking up. 2) When logging in to Azure, Microsoft has purposefully added "dark patterns" to hide options related to other, non-Microsoft-Authenticator technologies. They're available, but they're always tiny, tiny links squirrelled away so that you're inexorably lead towards using the Authenticator app. Someone at Redmond really wanted their KPIs met at Yubikey's expense. 3) If you get a new iPhone, unlike everything else on the phone, the Authenticator app will not transfer your MFA registrations. Apple IOS will securely transfer your accounts, passwords, etc... but Authenticator is special. You need to first configure a consumer account(!) to back up your enterprise MFA settings, and then restore them manually. At which point... none of them will work, and you get partial instructions that you can't follow. If you've wiped your old phone (e.g.: trade-in or repair), you are now locked out. All of the above were designed, architected, and developed on purpose. None of these are oversights, bugs, or missing features.
  • dr-detroit 5y ago
    Why isn't your widows deployment configured to use your enterprise SSO?
  • dijit 5y ago
    Your third point is not actually true. Well, it is true, but there are a lot of other apps which don’t transfer to new phones. Google’s Authenticator app is such an example. From what I understand: anything using the Secure Enclave as primary storage cannot be transferred.
    • WorldMaker 5y ago
      The consumer "workaround" mentioned uses some sort of iCloud "Secure Enclave" Backup file of some sort and will restore data on a new phone if you use the "Recovery" option, which does transfer regular boring TOTP and the primary "consumer" MSA account and the recovery locks/bricks the same data on the previous phone in the process. The additional issue mentioned is that while it works great for the MSA account and any boring TOTP you have setup it doesn't work at all for other Azure AD accounts of seemingly any stripe (Corporate Microsoft 365 accounts, B2B, B2C), which is surprising given it is Microsoft's Authenticator and they highly recommend using it, but it fails for Corporate MFA transfers. It just gives an error icon and not very useful error message.
• seqizz 5y ago
  Organizations must place some people who can take the initiative, do some actions. Whole thing could be solved by a "normal" support employee who can understand that there is a logical issue, and act on it. People tend to follow the instructions 1:1, because it's never risky.
• sofixa 5y ago
  Microsoft's user UX is just plain terrible. I recently tried Xcloud gaming or whatever it's called now, and it literally took me ~30 minutes of jumping between the US and FR ( I'm physically in France but have English as my preferred language in my browser, and holy hell do they not anticipate such a thing) versions of Xcloud Gaminf, Xbox something, Gamepass etc. with random 404s from times to times on links. In the end I managed to get the trial version, and i put a card that was expiring soon. Well it did expire, and when i try to update it it gives me a popup with a (Backend unavailable) message. And it's been like this for days. I tried cancelling the subscription, but it just sent me to a non-existing page...
• kgizdov 5y ago
  Microsoft VP Identity Division, Alex Simons, apologised on twitter and said they will release a fix overnight. I was actually able to log into my account today. But before you get too excited, what they've done is they've completely disabled the sign-in preferences menu and still have the bug - I cannot enable password-less login as it tries to send a notification to my phone, but that is no longer listed on my account. But the system clearly knows about it and wants to send a notification. Unfortunately, it cannot because it also requires it to be a sign-in option. It's a crazy loop of madness.
• kgizdov 5y ago
  OMG, guys, thank you very much. Never imagined this would hit front page or even someone ever doing something about it. You've made my day!
  • nikanj 5y ago
    Reaching the front page of HN / Reddit / etc is the only way to get support from Microsoft / Google / etc. At some point during their growth, companies just flat out cut all ties between customers and people who actually work there. The only way for a customer to reach the people writing the code (and able to fix the error 500) is through external channels. Same for billing issues and similar problems too, there's people working in the billing department but customer service is utterly incapable of actually reaching them.
    • kgizdov 5y ago
      True. It's a sad state of affairs. I doubt many get lucky enough to get this far. I am hoping at least that this is one post nudging the status quo in a better direction even if only a little bit.
• shantnutiwari 5y ago
  Another case that was resolved by the HN tech support forum. I wonder what happens when cases like this dont reach front page of HN?
• 1cvmask 5y ago
  No one ever got fired for buying Microsoft/IBM etc... I always prefer Zoom but cringe when the other side insists on Microsoft Teams. I always seem to have a new problem with them or others on the call having problems with them. The never ending litany of new "edge" cases never ever seem to be resolved. It's the whack-a-mole software approach. But companies continue to adopt Microsoft. We at saas pass have so many companies come to us for MFA after finding out different flaws in their MFA. But these flaws seem to be systemic with all their products. I can't think of a single Microsoft product that is best of breed. Yet I also think Microsoft will continue to increase revenue regardless of how bad their products are architected.
  • deleted 5y ago
    [deleted]
• karlkloss 5y ago
  Why would you want to use a MS login in the first place? If something important doesn't work without a MS/FB/Google/whatever login, then I send them a hearty FU and move on. And guess what? I'm still alive.
  • ceejayoz 5y ago
    My kids’ school is heavily invested in Teams. (They’ve also got Minecraft, which is less critical, not that they’d agree.)
  • stillblue 5y ago
    How do you sign up for something like Azure or Office 365 without an MS login? I'm curious
• 2ion 5y ago
  After digging a bit in Azure for the purpose of checking it out I left in despair and utterly confused how identity, policy and permission intertwine. Bonus points for enabling Azure DevOps on a Github account and finding out how that ties into your Azure account's identity management system. A platform that's impossible to use with confidence. Like the US code allows for finding something you're doing wrong with every step you take, the Microsoft platform creates the opportunity more making serious mistakes.