4 ms·
Those ms-msa URLs are for bootstrapping the system formerly know as PhoneFactor. It's not a TOTP at all, it's a two-way random value challenge. Microsoft suppor
by jcrawfordor 3y ago
Those ms-msa URLs are for bootstrapping the system formerly know as PhoneFactor. It's not a TOTP at all, it's a two-way random value challenge. Microsoft supports TOTP as well, but Authenticator push challenges are more resistant to several types of attacks than TOTP, so some Azure AD admins may make it the only option. There's also a convenience factor since manually entering numbers isn't necessarily required.
- rollcat 3y agoMFA via push notifications is vulnerable to the "keep spamming them until they tap allow" attack. You can make the user type a code (like Apple does), but that's it for convenience.
- jcrawfordor 3y agoMicrosoft allows the administrator to configure either "select one of three" or have the user enter a two-digit code. The default is "select one of three," but there is also some risk scoring to tune which mode a user gets.
- WirelessGigabit 3y agoOffice 365 for Business now has 'enter 2 digits' whereas the personal one defaults to 1 out of 3.
- jmprspret 3y agoThey also don't work at all when there's a network outage and you have no mobile data on your phone. (Whereas TOTP would work). An issue I have run into before.