Back in June I had the pleasure of delivering a training on Azure Active Directory to two customer crowds.  I say pleasure because not only do I love to share knowledge but also, the preparation of the training forces me to go deep on some aspects of what I’m going to teach.

In that training there were 8 labs and I thought it would be great to share them to the more general public.  The labs follow each other and build on each other.

You can find the exhaustive list in Cloud Identity & Azure Active Directory page.  This is the eight and last lab.

In the current lab we configure AAD to provide multi-factor authentication.

Create MFA provider

1. Go to the legacy portal @ https://manage.windowsazure.com
2. Scroll down the left menu to the bottom and select Active Directory
   
3. You should see the following screen
   
4. Select Multi-Factor Auth Providers
5. Select Create a new multi-factor authentication provider
   
6. Fill in the form
   
   • Name: DemoProvider
   • Usage Model: Leave it as it is for the demo
   • Subscription: Select the subscription you are using
   • Directory: Select the directory you have created in a previous lab
7. Click Create button
8. You should see the following screen
   
9. In the screen bottom, click Manage
10. This will open a new web page
    
11. Click the Configure link (next to the gear icon)
12. Here you could setup different policies on the MFA of your users
13. On the left hand menu, select Caching
14. Here you could define different caches to streamline authentication process, i.e. removing MFA once the user has authenticated using MFA for a time duration
15. On the left hand menu, select Voice Messages
16. Here you could configure personalized voice messages
17. Close the browser page

Enable users for MFA

1. Go to the legacy portal @ https://manage.windowsazure.com
2. Scroll down the left menu to the bottom and select Active Directory
   
3. You should see the following screen
   
4. Select a tenant you created for this lab & enter it
   
5. Select the Users menu
6. At the screen bottom, click the Manage Multi-Factor Auth button
7. This will open a new web page
   
8. Select the first user, i.e. Alan Scott
9. In the right column, click the enable link
   
10. In the dialog box, click the Enable multi-factor auth button
    
11. Select the Service Settings tab at the top
    
12. Scroll down to the verification options
13. Select only text message to phone
    
14. Click the Save button
15. Close the web page
16. Back to the user list in the portal, select the first user (the one we just enabled) and enter it
    
17. Select the Work Info tab
18. Under Contact Info & Mobile Phone, select Canada (+1) as region
19. Enter your own mobile phone number
20. Click the Save button

Test MFA

1. Open an In private web browser
2. Navigate to https://portal.azure.com
3. Enter credentials
   • For the email, enter the full name of the user we just enabled, this can be found in the Users list (user name column) ; e.g.
     
   • Enter the password of the user
4. You will be prompted to setup MFA, click the Set it up now button
5. You should see the following screen (with your mobile phone instead of the orange rectangle)
   
6. Click the Contact Me button
7. You should receive a text message on your mobile phone with a 6 digits number
8. Enter that number in the web page
9. Click the Verify button
10. It should tell you verification successful
11. Click the Done button
12. You should proceed to the portal as an authenticated user

Post Lab

You can go back to the admin portal for MFA and try different configurations.