Microsoft Identity To-Do’s and Did-You-Knows for 2023
I want to share with you some updates on Microsoft Identity that I feel you should know about/be aware of for the year (and a bit after). This is a brief summary, look into the details yourself or contact me/us if you want to know more :)
Call to actions on impacting changes:
- IPv6 will become supported shortly. Are your Conditional Access policies prepared for this?
Call to action: Check whether you are using any public-facing IPv6-addresses that your organization (or other locations you use in Conditional Access) use to break out. Add them into your CA-policies in the proper way to prevent suddenly (unwantingly) blocking/allowing access
- Number matching will be turned on by Microsoft shortly. Is your organization ready for this?
Call to action: Not sure what that means? Make sure you read up on it. Furthermore, make sure your colleagues know this is coming and are expecting it, to prevent confusion and heavy loads or your servicedesk. Jan Bakker wrote some good guidance on what’s happening on the topic, check it out!
- Authentication policies are available in Azure AD. Are you already planning taking these into use?
Call to action: Traditional authentication method settings (for MFA and SSPR) will become deprecated going forward. Make sure you start planning your migration now so you are not unpleasantly surprised in the future
- The alternative for Azure AD Connect (AAD Connect) is here: Azure AD Connect Cloud Sync (yes, it’s a mouthful ;)
Call to action: Read up on it and see where/whether you can use it (in certain scenarios) for your organization already. Careful though, there are some great advantages (Azure AD GUI configuration, connecting disconnected forest, many to one syncs etc.), but also some caveats (no support yet for device sync and Exchange hybrid setups). See where you can use it, based on the comparison with AAD Connect, and plan a migration accordingly.
- Group writeback v2 on AAD Connect, my personal favorite!
Call to action: Group writeback is back (uhhh…), but better, a lot better! It supports loaaads more scenarios and has interesting features for everyone! Interested in making self-service app access requests and -reviews available for AD as well? Check! That’s an option. Want to extend PIM-functionality towards AD(-groups) as well? Check (still with a delay though)! Check it out, I am sure there’s a scenario within your organization you can use it for.
- Want to set a standard (system-preferred) MFA-method? Do so for your end-users
Call to action: Still a lot of people in your organization using traditional phonecalls or even text messages as their default method even though you triggered them to set up the Authenticator-app (which is safer)? Set a system-preferred MFA-method to get them to use the Authenticator-app for example. It saves them time and improves your organization’s security posture.
- MFA-server going out of support in 2024. Are you moving towards an alternative already?
Call to action: Make sure you are moving towards an alternative. Can you possibly natively integrate with Azure AD nowadays? Can you use the NPS extension?
Get Jop Gommans’s stories in your inbox
Join Medium for free to get updates from this writer.
These are the ones I wanted to trigger you for. Did I forget important ones? I’m curious to find out! Send me a message on LinkedIn or respond to this post. Thanks for reading! :)
