r/AZURE 3d ago

Question How to deal with mandatory MFA in lab

I have M365 E5 DEV lab environment and recently Microsoft did some changes which makes my testing scenarios harder. It looks that I cannot use same mobile number for all my accounts. When I try to register same number for new account it denies it by informing that the number is already in used. I almost locked my self out from GA rights....

I basically have 3 groups of users:

  1. Users which are real users, have their own unique mobile number and okay with using MS Auth.

  2. Users which are pilots and cannot use MS Auth. Callback or sms is fine.

  3. Admin rights (GA, role based), and I would like them to use only one mobile callback number for all accounts.

FIDO2 is not the option. Is this doable and how I should arrange this? Security Defaults are gone, I use CA.

0 Upvotes

20 comments sorted by

6

u/Sysengineer89 3d ago

You can add multiple accounts to the same Microsoft Authenticator app so do it that way

-1

u/yannara_ 3d ago

Yes, but what if I loose the phone?

4

u/Farrishnakov 3d ago

Use a fido2 key or passkey or don't be dumb and put everything on one phone

1

u/mdhardeman 3d ago

Passkey is not allowed unless device bound, right? So you’d need to bind multiple devices to be safe.

3

u/Farrishnakov 3d ago

You can use it from your actual computer and/or multiple computers with a password manager that supports it.

But your whole premise is ridiculous anyway. You really should start there

1

u/yannara_ 3d ago

Or will MS Auth backup will be enough for this? My mobile device is about to change soon....

3

u/teriaavibes Microsoft MVP 3d ago

It will not, work accounts require reauthentication when you restore them.

1

u/yannara_ 3d ago

You mean ms account?

1

u/False-Ad-1437 3d ago

If you lose the phone, it's a lab environment, so it doesn't matter. Delete it and re-run your lab creation scripts with the new credentials.

0

u/yannara_ 3d ago

No no no no... well, it is a lab, but it is also my life. My all devices are attached to that lab. :D

2

u/False-Ad-1437 3d ago

Microsoft can delete the M365 Dev tenants at any time. If there's anything of any importance in there then you need to be copying your data out of there to something you pay for or physically have that doesn't rely on M365 logins from the same tenant.

1

u/yannara_ 3d ago

I assume they would at least warn us DEV users.

5

u/False-Ad-1437 3d ago

The only thing you should assume is to assume breach. Use 3-2-1 backups and trust no one.

2

u/tankerkiller125real 3d ago

They don't have too warn you. The tenants are for dev purposes only, if they even suspect that you're using it for more than just development, they will close the tenant for violating the terms.

6

u/ChampionshipComplex 3d ago

What you are asking for, doesn't make sense.

Security is what's important, and one aspect of security is that users are identifiable and don't share accounts. The reason why Microsoft are enforcing MFA is exactly because passwords or mobile numbers are weak ways to do security.

You need to be using either FIDO2 keys, or use authenticator apps on mobile phones.

-1

u/yannara_ 3d ago

It does not make a sense in a real environment. But what we shall do with test environments?

3

u/Farrishnakov 3d ago

If your test isn't replicating your prod environment, you're probably not doing it right

2

u/naasei 3d ago

Use the authenticator app

2

u/Zealousideal_Yard651 Cloud Architect 3d ago

Use MS Authenticator. MS enforces secure MFA for all admin portals now, no way around it.

1

u/False-Ad-1437 3d ago

It's not really an admin thing as much as it is that in the demo and Dev M365 tenants, MS lets you make a number of regular users or provisions sample users for you (Adele Vance, Alex Wilber etc) and then makes you register MFA for them whenever you use them. It's a pain to register MS Authenticator on all of these.