3 ms·

Yes, it's annoying that Microsoft are doing this. I have an OTP app, most things support standard HOTP or TOTP so I only need one app. Azure seems to have start

by ajb 4y ago

Yes, it's annoying that Microsoft are doing this. I have an OTP app, most things support standard HOTP or TOTP so I only need one app. Azure seems to have started to insist that you use a Microsoft app or SMS.

tinus_hn 4y ago
It’s the old playbook of Embrace, Enhance, Extinguish.
- jmclnx 4y ago
  Nice seeing this little victory, but a big one for the students. But to me is what M/S is doing with their WSL (and secure boot). They want to get to the point were Linux can only execute under Windows on new Laptops. The Companies that control Linux (yes, Linux is now pwned by corporate interests) do not care what really happens to Linux as long as Wall Street is happy.
  - the_third_wave 4y ago
    > yes, Linux is now pwned by corporate interests While Linux is big business it is not {p|o}wned by big business. If those corporate interests suddenly all jump in bed with Microsoft (et al.) Linux-the-kernel will still be there as a free software project. Running it on new hardware may become harder but it will still run, drivers may be harder to come by but they will still be developed. Things will go back to where they started with Linux-the-kernel being developed by volunteers, The rest of what makes a Linux distribution will still be developed, projects like Gnome and the various Redhat-sponsored [1] infrastructure projects will suffer but there are so many alternatives that this will not be an issue. [1] Firefox wants to correct this to 'Hatred-sponsored'...
- JAlexoid 4y ago
  They went straight for Extinguish. Microsoft Authenticator is far from being any form of "Enchancement"
  - tinus_hn 4y ago
    You can set the system so it’s optional. That way they can claim its standards compliant and Microsoft Authenticator is just another implementation of a standard. That is Embrace. But there are enhancements, where the Microsoft Authenticator can enforce extra restrictions, that you can require. That is Extend. And then of course your users can’t login unless they use the Microsoft Authenticator. That is Extinguish.
DaiPlusPlus 4y ago
I use Azure with both Google Authenticator and Authy - the option to use a QR code to init a standard TOTP app is there, it’s just not-immediately-visible. …unless your AAD admin restricted the option to use standard TOTP and forced the use of MS Authenticator?
- Larrikin 4y ago
  I asked our sysadmin at work to enable it and found out it is only an option for personal accounts. Business accounts force you to use the Microsoft authenticator app.
  - DaiPlusPlus 4y ago
    I have an Organizational account. I’m not sure where they’re getting that from. UPDATE: This post from 2022 is MS's announcement of GA for TOTP and specifically mentions that you can use any TOTP app: https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/totp-based-mfa-for-azure-ad-is-now-generally-available/ba-p/3600448 https://techcommunity.microsoft.com/t5/microsoft-entra-azure... and the official docs here: https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-oath-tokens https://learn.microsoft.com/en-us/azure/active-directory/aut... I see the article says you need Azure AD P1 or P2, so I guess if you have a non-MSA organizational account in an AAD without P1/P2 then you'll be stuck with MS Authenticator - so that might explain that.
    - ajb 4y ago
      Hmm I'm going to have another look. Maybe it's not supported in the onboarding flow but you can add one later? Thanks for the links! I know our admin well enough to know that he wouldn't have switched it off deliberately - he would be in the same boat as me.
  - comte7092 4y ago
    This is not true. Source: my workplace has it enabled for business accounts.
rft 4y ago
I have no experience with MS AAD, but I saw something similar with GWorkspace. The TOTP option is not shown by default, you need to add a security key (e.g. YubiKey) or maybe (never tested) an Android phone. You can then add a TOTP, remove the other method and continue using TOTP. Maybe MS AAD has something similar? Then temporarily using a throwaway profile on a phone might be enough to get around that.

by ajb 4y ago

tinus_hn 4y ago

It’s the old playbook of Embrace, Enhance, Extinguish.

jmclnx 4y ago
Nice seeing this little victory, but a big one for the students. But to me is what M/S is doing with their WSL (and secure boot). They want to get to the point were Linux can only execute under Windows on new Laptops. The Companies that control Linux (yes, Linux is now pwned by corporate interests) do not care what really happens to Linux as long as Wall Street is happy.
- the_third_wave 4y ago
  > yes, Linux is now pwned by corporate interests While Linux is big business it is not {p|o}wned by big business. If those corporate interests suddenly all jump in bed with Microsoft (et al.) Linux-the-kernel will still be there as a free software project. Running it on new hardware may become harder but it will still run, drivers may be harder to come by but they will still be developed. Things will go back to where they started with Linux-the-kernel being developed by volunteers, The rest of what makes a Linux distribution will still be developed, projects like Gnome and the various Redhat-sponsored [1] infrastructure projects will suffer but there are so many alternatives that this will not be an issue. [1] Firefox wants to correct this to 'Hatred-sponsored'...
JAlexoid 4y ago
They went straight for Extinguish. Microsoft Authenticator is far from being any form of "Enchancement"
- tinus_hn 4y ago
  You can set the system so it’s optional. That way they can claim its standards compliant and Microsoft Authenticator is just another implementation of a standard. That is Embrace. But there are enhancements, where the Microsoft Authenticator can enforce extra restrictions, that you can require. That is Extend. And then of course your users can’t login unless they use the Microsoft Authenticator. That is Extinguish.

DaiPlusPlus 4y ago

I use Azure with both Google Authenticator and Authy - the option to use a QR code to init a standard TOTP app is there, it’s just not-immediately-visible. …unless your AAD admin restricted the option to use standard TOTP and forced the use of MS Authenticator?

Larrikin 4y ago
I asked our sysadmin at work to enable it and found out it is only an option for personal accounts. Business accounts force you to use the Microsoft authenticator app.
- DaiPlusPlus 4y ago
  I have an Organizational account. I’m not sure where they’re getting that from. UPDATE: This post from 2022 is MS's announcement of GA for TOTP and specifically mentions that you can use any TOTP app: https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/totp-based-mfa-for-azure-ad-is-now-generally-available/ba-p/3600448 https://techcommunity.microsoft.com/t5/microsoft-entra-azure... and the official docs here: https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-oath-tokens https://learn.microsoft.com/en-us/azure/active-directory/aut... I see the article says you need Azure AD P1 or P2, so I guess if you have a non-MSA organizational account in an AAD without P1/P2 then you'll be stuck with MS Authenticator - so that might explain that.
  - ajb 4y ago
    Hmm I'm going to have another look. Maybe it's not supported in the onboarding flow but you can add one later? Thanks for the links! I know our admin well enough to know that he wouldn't have switched it off deliberately - he would be in the same boat as me.
- comte7092 4y ago
  This is not true. Source: my workplace has it enabled for business accounts.

rft 4y ago

I have no experience with MS AAD, but I saw something similar with GWorkspace. The TOTP option is not shown by default, you need to add a security key (e.g. YubiKey) or maybe (never tested) an Android phone. You can then add a TOTP, remove the other method and continue using TOTP. Maybe MS AAD has something similar? Then temporarily using a throwaway profile on a phone might be enough to get around that.