social media, fitness apps and other websites where they have created accounts) and it may be that those platforms have their user database compromised. Whilst weak passwords can be relatively easily avoided by schools and universities by applying minimum password complexity rules, the reality is many users will leverage the same password in other online platforms (e.g.

This is particularly true in education where schools often have younger students who may not have a phone with which to perform the MFA action. MFA, or Multi Factor Authentication, is a process whereby a second form of identification is required (usually a smartphone app or SMS code message) which works very effectively, however can be challenging or time consuming for some end users. To learn more, read Your Pa$$word doesn’t matter. With MFA, knowing or cracking the password won’t be enough to gain access. There are over 300 million fraudulent sign-in attempts to our cloud services every day … MFA can block over 99.9 percent of account compromise attacks. In fact, in a 2019 Microsoft Security blog it was noted:

The following sections are included:Īttempts by bad actors to exploit weak or compromised passwords is one of the most common attack vectors experienced by organizations globally and education is no exception. It’s a lengthy post, however provides a good step by step overview on how to protect users from overseas identity attacks by blocking international authentication attempts through the use of Conditional Access without requiring MFA.

This post was inspired by recent conversations with partners and IT Admins in schools who were wanting to provide a layer of additional protection for students without requiring them to use MFA (usually, because younger students do not always have access to mobile phones).

Mfa conditional access