Combined security information registration
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit e841af0 · +16 −16 lines · also on GitHub
⋯ 20 unchanged lines
2121
2222
Before enabling the new experience, review this administrator-focused documentation and the user-focused documentation to ensure you understand the functionality and effect of this feature. Base your training on the [user documentation](https://support.microsoft.com/account-billing/set-up-your-security-info-from-a-sign-in-prompt-28180870-c256-4ebf-8bd7-5335571bf9a8) to prepare your users for the new experience and help to ensure a successful rollout.
2323
24
−Combined registration has rolled out to all customers in Azure and Azure for US Government. The portal control that allows you to switch from legacy to combined registration experience is removed after your tenant migrates to the combined registratione.
24
+Combined registration is rolled out to all customers in Azure and Azure for US Government. The portal control that allows you to switch from legacy to combined registration experience is removed after your tenant migrates to the combined registratione.
2525
2626
*My Account* pages are localized based on the language settings of the computer accessing the page. Microsoft stores the most recent language used in the browser cache, so subsequent attempts to access the pages continue to render in the last language used. If you clear the cache, the pages re-render.
2727
⋯ 24 unchanged lines
5252
>
5353
> Alternate phone can only be registered in *manage mode* on [Security info](https://aka.ms/mysecurityinfo) and requires Voice calls to be enabled in the Authentication methods policy.
5454
>
55
−> Office phone can only be registered in *Interrupt mode* if the users *Business phone* property has been set. Office phone can be added by users in *Manage mode* from [Security info](https://aka.ms/mysecurityinfo) without this requirement.
55
+> Office phone can only be registered in *Interrupt mode* if the users *Business phone* property is set. Office phone can be added by users in *Manage mode* from [Security info](https://aka.ms/mysecurityinfo) without this requirement.
5656
>
57
−> App passwords are available only to users who have been enforced for per-user MFA. App passwords aren't available to users who are enabled for Microsoft Entra multifactor authentication by a Conditional Access policy.
57
+> App passwords are available only to users who are enforced for per-user MFA. App passwords aren't available to users who are enabled for Microsoft Entra multifactor authentication by a Conditional Access policy.
5858
>
5959
> Passkeys (FIDO2) can also be provisioned by using a custom client or partner integration with Microsoft Graph. For more information, see our [APIs](https://aka.ms/passkeyprovision).
6060
⋯ 22 unchanged lines
8383
8484
### Interrupt mode
8585
86
−Combined registration adheres to both multifactor authentication and SSPR policies, if both are enabled for your tenant. These policies control whether a user is interrupted for registration during sign-in and which methods are available for registration. If only an SSPR policy is enabled, then users will be able to skip (indefinitely) the registration interruption and complete it at a later time.
86
+Combined registration adheres to both multifactor authentication and SSPR policies, if both are enabled for your tenant. These policies control whether a user is interrupted for registration during sign-in and which methods are available for registration. If only an SSPR policy is enabled, then users are be able to skip (indefinitely) the registration interruption and complete it at a later time.
8787
8888
The following are sample scenarios where users might be prompted to register or refresh their security info:
8989
⋯ 3 unchanged lines
9393
- *SSPR registration enforced:* Users are asked to register during sign-in. They register only SSPR methods.
9494
- *SSPR refresh enforced:* Users are required to review their security info at an interval set by the admin. Users are shown their info and can confirm the current info or make changes if needed.
9595
96
−When registration is enforced, users are shown the minimum number of methods needed to be compliant with both multifactor authentication and SSPR policies, from most to least secure. Users going through combined registration where both MFA and SSPR registration are enforced and the SSPR policy requires two methods will first be required to register an MFA method as the first method and can select another MFA or SSPR specific method as the second registered method (such as email, security questions, and so on)
96
+When registration is enforced, users are shown the minimum number of methods needed to be compliant with both multifactor authentication and SSPR policies, from most to least secure. Users going through combined registration where both MFA and SSPR registration are enforced, and the SSPR policy requires two methods, are first required to register an MFA method as the first method and can select another MFA or SSPR specific method as the second registered method (such as email, security questions, and so on)
9797
9898
Consider the following example scenario:
9999
100
−- A user is enabled for SSPR. The SSPR policy requires two methods to reset and has enabled Microsoft Authenticator app, email, and phone.
100
+- A user is enabled for SSPR. The SSPR policy requires two methods to reset and is enabled Microsoft Authenticator app, email, and phone.
101101
- When the user chooses to register, two methods are required:
102102
- The user is shown Microsoft Authenticator app and phone by default.
103103
- The user can choose to register email instead of Authenticator app or phone.
104104
105
−When they set up Microsoft Authenticator, the user can click **I want to setup a different method** to register other authentication methods. The list of available methods is determined by the Authentication methods policy for the tenant.
105
+When they set up Microsoft Authenticator, the user can select **I want to setup a different method** to register other authentication methods. The list of available methods is determined by the Authentication methods policy for the tenant.
106106
107107
:::image type="content" border="true" source="media/concept-registration-mfa-sspr-combined/choose.png" alt-text="Screenshot of how to choose another method when you set up Microsoft Authenticator.":::
108108
⋯ 11 unchanged lines
120120
121121
122122
### Session controls for Combined Registration
123
−By default Combined registration enforces all MFA capable users to strongly authenticate prior to registering or managing their security info. If a user is currently signed in and has previously completed MFA as part of a valid session, no additional MFA will be required by default, unless a user is attempting to add or modify a passkey (FIDO2) method. Adding or modifying a passkey (FIDO2) method requires users to have strongly authenticated within the past 5 minutes. If MFA hasn't been completed in the past 5 minutes, the user will be asked to sign-in and complete fresh MFA. Organizations can modify the authentication requirements by defining [Conditional Access policies for securing security info registration.](~/identity/conditional-access/policy-all-users-security-info-registration.md).
123
+By default Combined registration enforces all MFA capable users to strongly authenticate prior to registering or managing their security info. If a user is currently signed in, and previously completed MFA as part of a valid session, no additional MFA is required by default, unless a user is attempting to add or modify a passkey (FIDO2) method. Adding or modifying a passkey (FIDO2) method requires users to have strongly authenticated within the past 5 minutes. If MFA hasn't been completed in the past 5 minutes, the user is asked to sign-in and complete fresh MFA. Organizations can modify the authentication requirements by defining [Conditional Access policies for securing security info registration.](~/identity/conditional-access/policy-all-users-security-info-registration.md).
124124
125
−Combined registration sessions are only valid for 15 minutes. If a users registration or management actions take longer than this time period, the session will expire and the user will be asked to sign back in to continue.
125
+Combined registration sessions are only valid for 15 minutes. If a user's registration or management actions take longer than this time period, the session expires and the user is asked to sign back in to continue.
126126
127127
## Key usage scenarios
128128
129129
### Change a password in MySignIns
130
−A user navigates to [Security info](https://aka.ms/mysecurityinfo). After signing in, the user can change their password. If the user authenticates with a password and a multifactor authentication method, they will be able to use the enhanced user experience to change their password without entering their existing password. When finished, the user has the new password updated on the Security info page. Authentication methods such as Temporary Access Pass (TAP) aren't supported for password change unless the user knows their existing password.
130
+A user navigates to [Security info](https://aka.ms/mysecurityinfo). After signing in, the user can change their password. If the user authenticates with a password and a multifactor authentication method, they're able to use the enhanced user experience to change their password without entering their existing password. When finished, the user has the new password updated on the Security info page. Authentication methods such as Temporary Access Pass (TAP) aren't supported for password change unless the user knows their existing password.
131131
132132
>[!NOTE]
133133
>If you have any links that point to the legacy change password experience, update them to the following forward link to direct users to the new **My Sign Ins Change Password** experience: [https://go.microsoft.com/fwlink/?linkid=2224198](https://go.microsoft.com/fwlink/?linkid=2224198).
⋯ 4 unchanged lines
138138
139139
### Set up security info during sign-in
140140
141
−An admin has enforced registration.
141
+An admin enforced registration.
142142
143
−A user has not set up all required security info and goes to the Microsoft Entra admin center. After the user enters the user name and password, the user is prompted to set up security info. The user then follows the steps shown in the wizard to set up the required security info. If your settings allow it, the user can choose to set up methods other than those shown by default. After users complete the wizard, they review the methods they set up and their default method for multifactor authentication. To complete the setup process, the user confirms the info and continues to the Microsoft Entra admin center.
143
+A user hasn't set up all required security info and goes to the Microsoft Entra admin center. After the user enters the user name and password, the user is prompted to set up security info. The user then follows the steps shown in the wizard to set up the required security info. If your settings allow it, the user can choose to set up methods other than those shown by default. After users complete the wizard, they review the methods they set up and their default method for multifactor authentication. To complete the setup process, the user confirms the info and continues to the Microsoft Entra admin center.
144144
145145
### Set up security info from My Account
146146
⋯ 3 unchanged lines
150150
151151
### Set up other methods after partial registration
152152
153
−If a user has partially satisfied MFA or SSPR registration due to existing authentication method registrations performed by the user or admin, users will only be asked to register additional information allowed by the Authentication methods policy settings when registration is required. If more than one other authentication method is available for the user to choose and register, an option on the registration experience titled **I want to set up another method** will be shown and allow the user to set up their desired authentication method.
153
+If a user partially satisfied MFA or SSPR registration due to existing authentication method registrations performed by the user or admin, users are only be asked to register additional information allowed by the Authentication methods policy settings when registration is required. If more than one other authentication method is available for the user to choose and register, an option on the registration experience titled **I want to set up another method** is shown and allows the user to set up their desired authentication method.
154154
155155
:::image type="content" border="true" source="./media/concept-registration-mfa-sspr-combined/other-method.png" alt-text="Screenshot of how to set up another method." :::
156156
⋯ 14 unchanged lines
171171
This user is also configured with SMS/Text option on a resource tenant.
172172
If this user removes SMS/Text as one of the authentication options on their home tenant, they get confused when access to the resource tenant asks them to respond to SMS/Text message.
173173
174
−To switch the directory in the Microsoft Entra admin center, click the user account name in the upper right corner and click **Switch directory**.
174
+To switch the directory in the Microsoft Entra admin center, select the user account name in the upper right corner and select **Switch directory**.
175175
176176
177177
⋯ 6 unchanged lines
184184
> [!NOTE]
185185
> Customers attempting to register or manage security info through combined registration or the My Sign-ins page should use a modern browser such as Microsoft Edge.
186186
>
187
−> IE11 is not officially supported for creating a webview or browser in applications as it will not work as expected in all scenarios.
187
+> IE11 isn't officially supported for creating a webview or browser in applications as it doesn't work as expected in all scenarios.
188188
>
189
−> Applications that have not been updated and are still using Azure AD Authentication Library (ADAL) that rely on legacy webviews can fallback to older versions of Internet Explorer. In these scenarios, users will experience a blank page when directed to the My Sign-ins page. To resolve this issue, switch to a modern browser.
189
+> Applications that aren't updated and are still using Azure AD Authentication Library (ADAL) that rely on legacy webviews can fallback to older versions of Internet Explorer. In these scenarios, users experience a blank page when directed to the My Sign-ins page. To resolve this issue, switch to a modern browser.
190190
191191
## Next steps
192192
⋯ 5 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 05:03 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.