4 ms·
According to our CTO, it was related to security. With Microsoft, the TFA options did not include a hardware token. So now we can authenticate with a phone ca
by anonymousiam 5y ago
According to our CTO, it was related to security. With Microsoft, the TFA options did not include a hardware token. So now we can authenticate with a phone call, a text message, or a security token. ( https://www.okta.com/identity-101/security-token/ https://www.okta.com/identity-101/security-token/ )
The main advantage is that the hardware token can be used in areas where mobile phones are prohibited, and of course immunity from a SIM swap attack.
- vladvasiliu 5y agoThey do support hardware tokens. I use a Yubikey with it. However, support is spotty outside of Windows.
- anonymousiam 5y agoThere may have been other reasons not mentioned, such as Microsoft's tiered services model. It sometimes seems as if they deliberately provide poor solutions at the lower tiers. The USG is pretty pissed off about that. Also, Yubikey would would not work, because like mobile phones, USB devices are restricted in some areas.
- vladvasiliu 5y ago> Also, Yubikey would would not work, because like mobile phones, USB devices are restricted in some areas. What kind of token would work, then? Something that only generates a TOTP, like those fobs some banks used to give out?
- anonymousiam 5y agoYes. Same method as Google/Microsoft Authenticator, but implemented in a separate hardware device (fob).
- r00fus 5y agoMicrosoft's competitor to Okta is Azure AD. Why would authentication factor support rely on client OS?
- vladvasiliu 5y agoI agree with you, it shouldn't, as evidenced by another of their properties which works fine: GitHub. I don't know the actual answer to this question. My speculation is they don't want to have to support too many platforms, so they just flat out refuse to serve them.