Episode 433: Passkeys, Passwords, and the End of SMS MFA

WEBVTT
1
00:00:03.600 --> 00:00:06.080
- Welcome to episode 433
2
00:00:06.080 --> 00:00:09.359
- of the Microsoft Cloud IT Pro podcast recorded
3
00:00:09.359 --> 00:00:12.179
- live on 07/27/2026.
4
00:00:12.400 --> 00:00:14.639
- This is a show about Microsoft three sixty
5
00:00:14.639 --> 00:00:16.894
- five in Azure from the perspective of IT
6
00:00:16.894 --> 00:00:19.135
- pros and end users, where we discuss a
7
00:00:19.135 --> 00:00:21.454
- topic or recent news and how it relates
8
00:00:21.454 --> 00:00:24.975
- to you. Today, we discuss how Microsoft three
9
00:00:24.975 --> 00:00:26.035
- sixty five authentication
10
00:00:26.494 --> 00:00:29.969
- is moving from make passwords safer with MFA
11
00:00:30.449 --> 00:00:34.149
- to remove phishable authentication wherever possible.
12
00:00:34.609 --> 00:00:37.489
- The practical conversation for IT pros is no
13
00:00:37.489 --> 00:00:40.609
- longer just whether MFA is enabled, it is
14
00:00:40.609 --> 00:00:43.875
- which methods are allowed, which users are still
15
00:00:43.875 --> 00:00:45.335
- on SMS or voice,
16
00:00:45.715 --> 00:00:48.375
- how passkeys change the user experience,
17
00:00:48.755 --> 00:00:51.174
- and how to balance security, accessibility,
18
00:00:51.715 --> 00:00:53.815
- recovery, and the support load.
19
00:00:56.435 --> 00:00:59.189
- Blast off to our topic of the day.
20
00:00:59.189 --> 00:00:59.689
- To
21
00:00:59.990 --> 00:01:00.490
- authentication.
22
00:01:01.109 --> 00:01:03.289
- That's quite a topic. Authentication.
23
00:01:03.670 --> 00:01:05.829
- Yeah. So you you and I have been
24
00:01:05.829 --> 00:01:07.750
- maybe ranting a little bit in the background
25
00:01:07.750 --> 00:01:09.270
- to each other and figured this would make
26
00:01:09.270 --> 00:01:10.969
- for a a good conversation.
27
00:01:11.594 --> 00:01:13.935
- So there's this whole world in,
28
00:01:14.314 --> 00:01:17.194
- I I think, Microsoft land, and we'll probably
29
00:01:17.194 --> 00:01:20.334
- focus on the m three sixty five, but
30
00:01:20.715 --> 00:01:24.090
- largely applies to the same things of logging
31
00:01:24.090 --> 00:01:27.209
- into Azure or really any property that's bound
32
00:01:27.209 --> 00:01:30.590
- to Entra ID Yep. As an identity provider.
33
00:01:30.810 --> 00:01:33.310
- So there there's been this march from Microsoft
34
00:01:33.370 --> 00:01:34.989
- over the years to
35
00:01:35.450 --> 00:01:37.310
- move away from
36
00:01:38.034 --> 00:01:42.375
- making passwords safer with things like multifactor authentication
37
00:01:43.314 --> 00:01:45.895
- to just getting to a general stance of
38
00:01:46.594 --> 00:01:47.655
- phishable authentication
39
00:01:48.435 --> 00:01:51.239
- is not possible where wherever
40
00:01:51.619 --> 00:01:52.759
- it was possible
41
00:01:53.379 --> 00:01:55.540
- in the past. So that that's been a
42
00:01:55.540 --> 00:01:56.819
- a weird one. Right? Like, we're in this
43
00:01:56.819 --> 00:01:58.040
- world of transitioning
44
00:01:58.420 --> 00:01:58.920
- from
45
00:01:59.379 --> 00:02:02.180
- MFA and MFA enablement and all the things
46
00:02:02.180 --> 00:02:04.359
- we've done over the years to get there
47
00:02:04.724 --> 00:02:05.224
- to
48
00:02:05.685 --> 00:02:07.145
- a new set of methods,
49
00:02:07.685 --> 00:02:10.645
- which are allowed. And even out of that
50
00:02:10.645 --> 00:02:13.044
- set of methods, sometimes things are changing between,
51
00:02:13.044 --> 00:02:13.944
- like, SMS,
52
00:02:14.485 --> 00:02:14.985
- OTP.
53
00:02:15.685 --> 00:02:18.060
- You've got the whole world of, like, passkeys
54
00:02:18.060 --> 00:02:19.979
- are supposed to be better, but I think
55
00:02:19.979 --> 00:02:21.419
- you and I might rant a little bit
56
00:02:21.419 --> 00:02:22.560
- like, are they really?
57
00:02:23.580 --> 00:02:25.500
- And see where we come out. So I
58
00:02:25.500 --> 00:02:26.939
- think it'll be a fun conversation because we
59
00:02:26.939 --> 00:02:28.540
- get to kinda talk about the changes in
60
00:02:28.540 --> 00:02:29.919
- the authentication landscape,
61
00:02:30.405 --> 00:02:30.905
- what's
62
00:02:31.444 --> 00:02:33.924
- happened along the way, what's changed, what's in,
63
00:02:33.924 --> 00:02:34.824
- what's out,
64
00:02:35.284 --> 00:02:36.424
- and how
65
00:02:36.965 --> 00:02:40.084
- folks can think about maybe not baselining, but
66
00:02:40.084 --> 00:02:40.984
- maybe rebaselining,
67
00:02:41.444 --> 00:02:42.824
- how you think about security,
68
00:02:43.550 --> 00:02:46.430
- accessibility in a world of we're trying to
69
00:02:46.430 --> 00:02:49.169
- eliminate phishable authentication wherever possible.
70
00:02:49.629 --> 00:02:52.209
- What does things like account recovery look like?
71
00:02:52.269 --> 00:02:55.729
- What's your support burden with your end users,
72
00:02:56.125 --> 00:02:58.044
- and where does that fall out? So there's
73
00:02:58.044 --> 00:03:00.224
- a whole bunch to kinda peel apart
74
00:03:00.844 --> 00:03:03.905
- as we go through this one. So
75
00:03:04.604 --> 00:03:07.724
- you wanna start with maybe, like, passkeys and
76
00:03:07.724 --> 00:03:10.284
- m three sixty five because that's kinda becoming
77
00:03:10.284 --> 00:03:10.740
- the
78
00:03:11.219 --> 00:03:11.719
- default
79
00:03:12.500 --> 00:03:13.719
- authentication experience here
80
00:03:14.020 --> 00:03:16.620
- pretty soon. Yeah. September this year. Right. And
81
00:03:16.620 --> 00:03:19.159
- I was gonna say even some history
82
00:03:19.939 --> 00:03:21.939
- on that before we start talking about pass
83
00:03:21.939 --> 00:03:23.879
- keys, they are gonna be the default is
84
00:03:24.260 --> 00:03:26.564
- some of this came out too is that
85
00:03:27.264 --> 00:03:29.504
- Microsoft's been talking about this, but for a
86
00:03:29.504 --> 00:03:31.665
- little bit, but the road map came out
87
00:03:31.665 --> 00:03:33.504
- about this and there may be some new
88
00:03:33.504 --> 00:03:34.564
- dates is that
89
00:03:34.865 --> 00:03:36.784
- as a part of pass keys becoming the
90
00:03:36.784 --> 00:03:37.500
- new default,
91
00:03:37.900 --> 00:03:40.240
- Microsoft also announced that
92
00:03:40.620 --> 00:03:41.120
- SMS
93
00:03:41.580 --> 00:03:42.639
- and voice
94
00:03:43.180 --> 00:03:44.000
- for MFA
95
00:03:44.460 --> 00:03:47.099
- are going to be fully retired. So if
96
00:03:47.099 --> 00:03:48.319
- you are using
97
00:03:48.939 --> 00:03:50.719
- Intra for this stuff and
98
00:03:51.175 --> 00:03:53.435
- you're still relying on SMS invoice,
99
00:03:54.055 --> 00:03:56.314
- there is now an official timeline
100
00:03:57.014 --> 00:04:00.215
- from Microsoft on this that as of as
101
00:04:00.215 --> 00:04:01.435
- early as September
102
00:04:02.534 --> 00:04:04.694
- of this year, 2026,
103
00:04:04.694 --> 00:04:07.459
- September 18, Microsoft is going to give you
104
00:04:07.459 --> 00:04:09.080
- options for telecom providers
105
00:04:09.539 --> 00:04:11.459
- if you want to keep using SMS and
106
00:04:11.459 --> 00:04:13.300
- voice. They're no longer gonna offer it, but
107
00:04:13.300 --> 00:04:14.580
- they will give you the option to go
108
00:04:14.580 --> 00:04:16.339
- sign up with a third party telecom and
109
00:04:16.339 --> 00:04:18.979
- use it by October 2026,
110
00:04:18.980 --> 00:04:22.225
- October 30. Organizations still using voice have to
111
00:04:22.225 --> 00:04:24.785
- go to third party telecom. And then by
112
00:04:24.785 --> 00:04:26.305
- February 1
113
00:04:26.704 --> 00:04:28.884
- 02/01/2027,
114
00:04:29.105 --> 00:04:31.845
- SMS and voice is gonna be fully retired.
115
00:04:32.384 --> 00:04:35.605
- They're gonna be blocked from signing in, and
116
00:04:35.830 --> 00:04:37.750
- this is interesting. I think you'll still be
117
00:04:37.750 --> 00:04:40.170
- able to use third parties after 2027,
118
00:04:40.230 --> 00:04:43.029
- but the Microsoft one is gonna be just
119
00:04:43.029 --> 00:04:45.270
- gone. If you were using Microsoft at all
120
00:04:45.270 --> 00:04:47.509
- by February, you're gonna have to go to
121
00:04:47.509 --> 00:04:48.009
- passkeys,
122
00:04:48.564 --> 00:04:49.704
- which is why
123
00:04:50.324 --> 00:04:53.524
- in preparation for this, September 1 passkeys are
124
00:04:53.524 --> 00:04:55.524
- gonna become that default. Which I think is
125
00:04:55.524 --> 00:04:57.044
- gonna lead to a little bit of, like,
126
00:04:57.044 --> 00:04:58.985
- passkey fatigue for folks.
127
00:04:59.365 --> 00:05:00.264
- It's gonna be
128
00:05:01.389 --> 00:05:04.029
- gonna be a an interesting place, I think,
129
00:05:04.029 --> 00:05:06.670
- for customers to land. This is one of
130
00:05:06.670 --> 00:05:09.650
- these. Like, I have two very different perspectives
131
00:05:10.029 --> 00:05:10.689
- on passkeys.
132
00:05:11.150 --> 00:05:13.330
- I have my IT pro
133
00:05:13.870 --> 00:05:14.370
- security
134
00:05:15.404 --> 00:05:16.625
- passkeys are
135
00:05:16.925 --> 00:05:18.145
- awesome standpoint
136
00:05:18.605 --> 00:05:19.105
- because
137
00:05:19.805 --> 00:05:22.444
- SMS, voice, phishing I mean, the more we
138
00:05:22.444 --> 00:05:24.944
- can get to passkeys and no passwords.
139
00:05:25.324 --> 00:05:27.805
- From a security perspective, I'm all for that.
140
00:05:27.805 --> 00:05:29.105
- From an end user perspective,
141
00:05:29.519 --> 00:05:31.759
- I've had some challenges with passkeys, and I'm
142
00:05:31.759 --> 00:05:34.899
- like, this is we're in this IT landscape.
143
00:05:35.120 --> 00:05:37.300
- We're used to dealing with technology
144
00:05:38.079 --> 00:05:40.800
- and passkeys I can get around. I think
145
00:05:40.800 --> 00:05:42.399
- to some users and some people I deal
146
00:05:42.399 --> 00:05:45.664
- with, and I'm like, this could be interesting
147
00:05:45.884 --> 00:05:47.485
- to say the least. I think it is
148
00:05:47.485 --> 00:05:48.384
- a little bit of
149
00:05:48.764 --> 00:05:49.344
- a a hurdle.
150
00:05:50.125 --> 00:05:51.584
- Everything out there is
151
00:05:52.284 --> 00:05:55.164
- ever so slightly different. And I think in
152
00:05:55.164 --> 00:05:57.459
- the world of m three sixty five and
153
00:05:57.459 --> 00:06:01.699
- passkeys, it's kinda muddied even further because you're
154
00:06:01.699 --> 00:06:02.599
- locked into
155
00:06:03.539 --> 00:06:04.839
- the Microsoft ecosystem
156
00:06:05.379 --> 00:06:07.300
- for better or worse. Like, we were talking
157
00:06:07.300 --> 00:06:09.314
- about this maybe last week or the week
158
00:06:09.314 --> 00:06:09.814
- before.
159
00:06:10.915 --> 00:06:12.514
- I would really like to be able to,
160
00:06:12.514 --> 00:06:14.214
- like, manage my passkey
161
00:06:14.675 --> 00:06:17.254
- for something like my Entra ID
162
00:06:17.714 --> 00:06:21.475
- in one password where every other passkey that
163
00:06:21.475 --> 00:06:23.290
- I have is. Guess what I can't manage
164
00:06:23.290 --> 00:06:25.529
- in one password? I have to use the
165
00:06:25.529 --> 00:06:28.650
- Microsoft Authenticator app, which has been losing features
166
00:06:28.650 --> 00:06:30.170
- over the years. You would think it's getting
167
00:06:30.170 --> 00:06:33.230
- more streamlined and better. Like, it's not better.
168
00:06:33.290 --> 00:06:33.689
- It's
169
00:06:34.650 --> 00:06:36.580
- it kinda sits out there and continues to
170
00:06:36.580 --> 00:06:39.214
- persist. But things like doing, like, a passkey
171
00:06:39.274 --> 00:06:42.495
- through the authenticator app are infuriating
172
00:06:42.795 --> 00:06:44.654
- versus just doing them in your browser
173
00:06:45.035 --> 00:06:47.754
- or through a password manager, be it one
174
00:06:47.754 --> 00:06:49.214
- password or bitwarden
175
00:06:49.970 --> 00:06:50.790
- or anything
176
00:06:51.170 --> 00:06:53.170
- like that. So I I think that's part
177
00:06:53.170 --> 00:06:54.550
- of it is, like, Microsoft
178
00:06:54.930 --> 00:06:56.949
- locks you into an ecosystem
179
00:06:57.410 --> 00:06:59.810
- that maybe isn't as friendly or isn't doing
180
00:06:59.810 --> 00:07:01.490
- the things that you're doing in other parts
181
00:07:01.490 --> 00:07:03.509
- of it, which makes it a little harder
182
00:07:03.569 --> 00:07:06.454
- to kinda onboard to and smooth
183
00:07:06.915 --> 00:07:09.475
- out. And, you know, it also has its
184
00:07:09.475 --> 00:07:11.714
- own fits and bumps along the way. So,
185
00:07:11.714 --> 00:07:13.495
- like, if I go and authenticate
186
00:07:13.954 --> 00:07:14.454
- to
187
00:07:14.995 --> 00:07:17.794
- m three sixty five and my organization requires
188
00:07:17.794 --> 00:07:19.014
- me to use
189
00:07:19.629 --> 00:07:21.870
- use a a pass key, well, that's great.
190
00:07:21.870 --> 00:07:23.230
- So I've got that pass key on my
191
00:07:23.230 --> 00:07:25.310
- phone. I've got the authenticator app installed. So
192
00:07:25.310 --> 00:07:27.230
- let's go ahead and pull that up. Alright.
193
00:07:27.230 --> 00:07:29.710
- Let me scan the QR code. Yep. I
194
00:07:29.710 --> 00:07:31.250
- scanned the QR code,
195
00:07:31.675 --> 00:07:33.995
- authenticated with my face or touch ID or
196
00:07:33.995 --> 00:07:35.854
- fingerprint, whatever it happened to be.
197
00:07:36.154 --> 00:07:38.235
- And then you kinda gotta wait for the
198
00:07:38.235 --> 00:07:41.194
- magic to happen. So I find this part
199
00:07:41.194 --> 00:07:44.870
- to be kind of infuriating across every operating
200
00:07:44.870 --> 00:07:46.250
- system, be it, like,
201
00:07:46.629 --> 00:07:48.949
- a a Mac or Windows device is I
202
00:07:48.949 --> 00:07:50.790
- sit here and I I I authenticate on
203
00:07:50.790 --> 00:07:52.229
- my phone, and then I gotta wait for
204
00:07:52.229 --> 00:07:53.449
- it to connect over Bluetooth
205
00:07:54.310 --> 00:07:55.529
- and find my device.
206
00:07:55.910 --> 00:07:57.449
- And, hopefully, it connects.
207
00:07:57.854 --> 00:07:59.935
- Sometimes, it connects in, like, two seconds, and
208
00:07:59.935 --> 00:08:01.535
- it's like, oh, wow. That that went through
209
00:08:01.535 --> 00:08:03.454
- and it was magical. Sometimes it just sits
210
00:08:03.454 --> 00:08:06.035
- and spins forever, and it's the most infuriating
211
00:08:06.095 --> 00:08:08.574
- thing because you don't know what happened. And
212
00:08:08.574 --> 00:08:10.574
- it'll do these crazy things, like, it'll time
213
00:08:10.574 --> 00:08:12.759
- out. And then that QR code is now
214
00:08:12.759 --> 00:08:14.839
- invalid. You gotta go back, generate another one,
215
00:08:14.839 --> 00:08:17.719
- start your authentication flow. Like, it's very, like,
216
00:08:17.719 --> 00:08:19.099
- black box in the implementation
217
00:08:19.719 --> 00:08:21.560
- and the way Microsoft did it, I think,
218
00:08:21.560 --> 00:08:23.479
- versus the way you can hit it in
219
00:08:23.479 --> 00:08:26.044
- other parts of the ecosystem.
220
00:08:26.504 --> 00:08:27.944
- Say if you were to just be able
221
00:08:27.944 --> 00:08:29.704
- to, like, store your passkey in a password
222
00:08:29.704 --> 00:08:32.825
- manager or your local browser or things like
223
00:08:32.825 --> 00:08:35.725
- that. My my Microsoft has made some deliberate
224
00:08:35.784 --> 00:08:37.404
- choices there, and
225
00:08:37.784 --> 00:08:39.870
- some of them have, I think, just
226
00:08:40.509 --> 00:08:43.389
- additional friction that that make them just ever
227
00:08:43.389 --> 00:08:45.870
- so slightly harder to use an onboard with
228
00:08:45.870 --> 00:08:47.549
- and then to train your users on. Like
229
00:08:47.549 --> 00:08:49.070
- you said, like, I think you and I
230
00:08:49.070 --> 00:08:50.909
- are pretty I think it's fair to say,
231
00:08:50.909 --> 00:08:52.589
- like, we're savvy when it comes to this
232
00:08:52.589 --> 00:08:53.809
- stuff, and
233
00:08:54.445 --> 00:08:56.304
- it infuriates me at times.
234
00:08:57.084 --> 00:08:58.225
- Like, that doesn't make
235
00:08:58.605 --> 00:09:00.605
- it very high on things like the WAF,
236
00:09:00.605 --> 00:09:02.684
- the with the wife acceptance factor for something
237
00:09:02.684 --> 00:09:04.924
- like this would be pretty low. Right? If
238
00:09:04.924 --> 00:09:06.690
- I told my wife, like, hey. Every time
239
00:09:06.690 --> 00:09:08.450
- you need to log in to your email
240
00:09:08.450 --> 00:09:10.710
- account, you have to jump through this hoop,
241
00:09:10.850 --> 00:09:12.950
- she would, I think, just stop using email.
242
00:09:13.009 --> 00:09:15.170
- It is. And there was an interesting article
243
00:09:15.170 --> 00:09:18.210
- that came out too from on How to
244
00:09:18.210 --> 00:09:19.490
- Geek that we'll link to in the show
245
00:09:19.490 --> 00:09:22.184
- notes where it talks about some of this
246
00:09:22.264 --> 00:09:22.924
- too where
247
00:09:23.304 --> 00:09:25.164
- passkeys are supposed to replace passwords.
248
00:09:25.784 --> 00:09:27.784
- Microsoft is obviously trying to move in this
249
00:09:27.784 --> 00:09:29.004
- direction with passkeys.
250
00:09:29.625 --> 00:09:31.705
- They did it, I mean, what, three or
251
00:09:31.705 --> 00:09:33.865
- four or five years ago already with personal
252
00:09:33.865 --> 00:09:36.044
- Microsoft accounts so you could delete your password,
253
00:09:36.670 --> 00:09:39.629
- but they're still confusing. And you were mentioning
254
00:09:39.629 --> 00:09:41.470
- your wife, I know my wife would fall
255
00:09:41.470 --> 00:09:43.790
- in this boat as well, is and this
256
00:09:43.790 --> 00:09:44.290
- article
257
00:09:44.670 --> 00:09:46.910
- kinda hints at us as that passkeys are
258
00:09:46.910 --> 00:09:48.769
- just kind of happening,
259
00:09:49.550 --> 00:09:52.054
- but there's not a lot of I think
260
00:09:52.054 --> 00:09:52.714
- it's confusing.
261
00:09:53.014 --> 00:09:55.995
- It's hard for users to understand and, like,
262
00:09:56.454 --> 00:09:57.514
- what is a passkey?
263
00:09:58.054 --> 00:09:59.735
- You mentioned this earlier. It's like, I can
264
00:09:59.735 --> 00:10:02.054
- do passkeys on authenticator. I can do passkeys
265
00:10:02.054 --> 00:10:04.475
- in one password. I can do passkeys on
266
00:10:04.934 --> 00:10:06.875
- USB keys, on FIDO two keys.
267
00:10:07.420 --> 00:10:07.920
- Technically,
268
00:10:08.460 --> 00:10:10.940
- pass keys can be stored on Windows using
269
00:10:10.940 --> 00:10:12.639
- Windows Hello for Business.
270
00:10:13.179 --> 00:10:15.980
- Like, in the past, the password is a
271
00:10:15.980 --> 00:10:19.200
- password. Everybody kind of understood usernames and passwords,
272
00:10:19.495 --> 00:10:21.735
- And passkeys are like, well, where are they
273
00:10:21.735 --> 00:10:22.235
- stored?
274
00:10:22.774 --> 00:10:24.075
- Different websites
275
00:10:24.535 --> 00:10:26.235
- can store them different places.
276
00:10:27.014 --> 00:10:28.394
- Different things are supported.
277
00:10:28.934 --> 00:10:32.315
- And trying to get from a user perspective,
278
00:10:33.339 --> 00:10:36.460
- how do you get users to understand this?
279
00:10:36.460 --> 00:10:39.279
- How do you get users to adopt this?
280
00:10:39.419 --> 00:10:42.399
- And what does that user experience look like
281
00:10:42.539 --> 00:10:43.039
- is
282
00:10:43.500 --> 00:10:46.059
- I feel like it's a challenge, especially, like
283
00:10:46.059 --> 00:10:48.684
- you said, for those non IT users that
284
00:10:48.684 --> 00:10:50.524
- aren't really used to it. They don't really
285
00:10:50.524 --> 00:10:51.485
- know what it is, and some of them
286
00:10:51.485 --> 00:10:53.325
- are like, well, where do I store this?
287
00:10:53.325 --> 00:10:55.725
- And, I mean, to my perspective, one password's
288
00:10:55.725 --> 00:10:57.184
- great because if I switch devices,
289
00:10:57.725 --> 00:11:00.045
- my passkey goes with me. But what if
290
00:11:00.045 --> 00:11:02.299
- when I replace my phone and all my
291
00:11:02.299 --> 00:11:04.460
- passkeys are there, my passkeys are on my
292
00:11:04.460 --> 00:11:06.540
- computer, and I go to a new computer,
293
00:11:06.540 --> 00:11:09.019
- but I all my passkeys were locked up
294
00:11:09.019 --> 00:11:11.259
- in Windows Hello for Business on my old
295
00:11:11.259 --> 00:11:11.759
- computer.
296
00:11:12.299 --> 00:11:13.840
- There's a lot more
297
00:11:14.355 --> 00:11:14.855
- complexity
298
00:11:15.475 --> 00:11:17.315
- to passkeys and I think a lot more
299
00:11:17.315 --> 00:11:20.195
- user education that has to happen when you
300
00:11:20.195 --> 00:11:22.914
- start looking at how do you push these
301
00:11:22.914 --> 00:11:24.754
- out and deploy these to end users. For
302
00:11:24.754 --> 00:11:26.210
- sure. I think just even, like, like like,
303
00:11:26.210 --> 00:11:27.990
- the onboarding flow alone
304
00:11:28.450 --> 00:11:31.090
- is enough to kinda think about and get
305
00:11:31.090 --> 00:11:33.970
- through. And then how do you wanna configure
306
00:11:33.970 --> 00:11:36.210
- your environment, I think, is another part of
307
00:11:36.210 --> 00:11:38.769
- it. Like, I think some organizations would say,
308
00:11:38.769 --> 00:11:40.290
- hey. Like, hey. Pass keys are, like, the
309
00:11:40.290 --> 00:11:41.865
- end all be all. Let's go do them.
310
00:11:42.345 --> 00:11:44.184
- And sometimes that's at the expense of making
311
00:11:44.184 --> 00:11:46.345
- other forms of authentication, maybe even, like, a
312
00:11:46.345 --> 00:11:48.184
- little bit more friction or harder to use.
313
00:11:48.184 --> 00:11:49.784
- So you might say, like, hey. I'm gonna
314
00:11:49.784 --> 00:11:52.024
- keep a token for a pass key alive
315
00:11:52.024 --> 00:11:54.024
- for twenty four hours, but sorry if you
316
00:11:54.024 --> 00:11:54.524
- authenticate
317
00:11:55.065 --> 00:11:57.240
- by hardware key, by, like, a YubiKey or
318
00:11:57.240 --> 00:11:59.259
- something like that. I'm gonna make you reauthenticate
319
00:11:59.399 --> 00:12:01.240
- every two hours because you have the little
320
00:12:01.240 --> 00:12:02.679
- key in there. Right? It should be easy.
321
00:12:02.679 --> 00:12:05.179
- It won't interrupt your flow at all, except
322
00:12:06.360 --> 00:12:08.534
- it really does interrupt your
323
00:12:08.934 --> 00:12:11.754
- interrupt your flow. So so maybe before we
324
00:12:11.894 --> 00:12:14.214
- dive too deep into our rant about pass
325
00:12:14.214 --> 00:12:16.054
- keys, we should talk about kinda, like, what's
326
00:12:16.054 --> 00:12:18.794
- out there today and what's going away and
327
00:12:18.934 --> 00:12:21.449
- what folks should maybe think about as you've
328
00:12:21.449 --> 00:12:23.709
- got this general march towards
329
00:12:24.169 --> 00:12:27.929
- passkeys for everybody. Yeah. It's coming. Right? Whether
330
00:12:27.929 --> 00:12:30.009
- you want it or not, it's coming. So
331
00:12:30.009 --> 00:12:32.089
- you do have to kinda prepare for it
332
00:12:32.089 --> 00:12:34.065
- and get ready. I've had clients already ask
333
00:12:38.865 --> 00:12:39.924
- wanna get to passwordless.
334
00:12:40.625 --> 00:12:42.384
- To your point, how do we do this?
335
00:12:42.384 --> 00:12:44.465
- What does this look like in terms of
336
00:12:44.465 --> 00:12:46.404
- an actual deployment? Even passwordless
337
00:12:46.865 --> 00:12:49.790
- is, I I think, a hard one for
338
00:12:49.790 --> 00:12:50.769
- folks to
339
00:12:51.149 --> 00:12:51.649
- understand
340
00:12:52.509 --> 00:12:55.870
- and get behind. So, like, I have parts
341
00:12:55.870 --> 00:12:57.790
- of the organization that I'm in. Like, sometimes,
342
00:12:57.790 --> 00:13:00.029
- like, we do have environments with passwords. Sometimes
343
00:13:00.029 --> 00:13:02.465
- we have ones without. I've seen folks, like,
344
00:13:02.465 --> 00:13:03.524
- get very confused
345
00:13:04.065 --> 00:13:06.644
- about which ones do and which ones don't
346
00:13:06.945 --> 00:13:08.945
- and how you can log in and what
347
00:13:08.945 --> 00:13:11.904
- you can log into with what. So, like,
348
00:13:11.904 --> 00:13:14.544
- I I have some environments which are driven
349
00:13:14.544 --> 00:13:18.000
- by pass keys, like hardware tokens, like YubiKeys,
350
00:13:18.059 --> 00:13:19.899
- things like that, and I can only log
351
00:13:19.899 --> 00:13:22.059
- in with a YubiKey. I have other places
352
00:13:22.059 --> 00:13:24.480
- where I can only log in with a
353
00:13:24.620 --> 00:13:27.259
- passkey via the authenticator app, and then I
354
00:13:27.259 --> 00:13:28.779
- have some places where I can still log
355
00:13:28.779 --> 00:13:30.904
- in with a password. So that's hard to
356
00:13:30.904 --> 00:13:33.245
- balance too. It's just, like, the context switch
357
00:13:33.865 --> 00:13:34.605
- and knowing
358
00:13:35.384 --> 00:13:37.625
- where you are at any given time and
359
00:13:37.625 --> 00:13:39.404
- kinda what's allowed in there. So
360
00:13:39.784 --> 00:13:42.365
- maybe most folks don't have, like, multiple environments
361
00:13:42.504 --> 00:13:44.745
- like that or things to think about along
362
00:13:44.745 --> 00:13:46.850
- those lines. But if you do, it's just
363
00:13:46.850 --> 00:13:49.509
- another component of end user
364
00:13:50.210 --> 00:13:52.309
- enablement that you need
365
00:13:52.690 --> 00:13:53.669
- to think about
366
00:13:54.450 --> 00:13:57.889
- along the way. Right. Microsoft does offer some
367
00:13:57.889 --> 00:14:00.049
- guidance here, right, to think about like like,
368
00:14:00.049 --> 00:14:01.544
- they have an article out there and learn.
369
00:14:01.625 --> 00:14:05.065
- Plan a phishing resistant passwordless authentication deployment in
370
00:14:05.065 --> 00:14:07.704
- Microsoft entry ID. And it kinda walks you
371
00:14:07.704 --> 00:14:09.704
- through, like, high level what to do, but
372
00:14:09.704 --> 00:14:11.485
- it very much focuses on
373
00:14:11.945 --> 00:14:12.924
- device readiness.
374
00:14:13.304 --> 00:14:15.625
- So, like, what is Windows 10 with Windows
375
00:14:15.625 --> 00:14:17.799
- Hello for Business enabled, Windows 11?
376
00:14:18.259 --> 00:14:20.279
- What do you get across, like, mobile platforms,
377
00:14:21.379 --> 00:14:21.879
- macOS,
378
00:14:22.819 --> 00:14:24.899
- things like that? It doesn't spend a bunch
379
00:14:24.899 --> 00:14:27.539
- of time on, like, end user personas, which
380
00:14:27.539 --> 00:14:29.220
- I think is an important part is, like,
381
00:14:29.220 --> 00:14:32.039
- understanding your audience and what you need to
382
00:14:32.259 --> 00:14:32.919
- dig into.
383
00:14:33.245 --> 00:14:34.845
- Like, they kind of wishy washy it and
384
00:14:34.845 --> 00:14:36.524
- they just say, oh, there's admins and there's
385
00:14:36.524 --> 00:14:37.024
- nonadmins.
386
00:14:37.404 --> 00:14:39.184
- Well, that's probably
387
00:14:39.565 --> 00:14:40.065
- not
388
00:14:40.524 --> 00:14:42.605
- the right way to think about it. Like,
389
00:14:42.605 --> 00:14:44.524
- arguably, there's gonna be folks in, like, I
390
00:14:44.524 --> 00:14:47.100
- don't know, like, let's say, like, finance or
391
00:14:47.100 --> 00:14:49.259
- HR, and somebody in finance might have a
392
00:14:49.259 --> 00:14:51.120
- different authentication method to
393
00:14:51.500 --> 00:14:53.759
- system x y x versus
394
00:14:54.460 --> 00:14:56.620
- system y or system z or things like
395
00:14:56.620 --> 00:14:59.820
- that depending on what that thing is and
396
00:14:59.820 --> 00:15:01.915
- how important the data is in it and
397
00:15:01.915 --> 00:15:03.674
- everything else. So I think you gotta spend
398
00:15:03.674 --> 00:15:05.754
- a little bit more time on kinda planning
399
00:15:05.754 --> 00:15:08.554
- and personas, understand your organization, and then be
400
00:15:08.554 --> 00:15:11.215
- able to map those things back into
401
00:15:12.154 --> 00:15:14.014
- those various authentication methods
402
00:15:14.350 --> 00:15:16.509
- and what you want to enable where or
403
00:15:16.509 --> 00:15:18.269
- how you want to enable where, I guess.
404
00:15:18.269 --> 00:15:20.029
- You mentioned going back and talking through those.
405
00:15:20.029 --> 00:15:21.889
- Did you wanna kinda work through
406
00:15:22.350 --> 00:15:24.830
- what are those different ones? I guess, kinda
407
00:15:24.830 --> 00:15:27.230
- thinking at it from a more of an
408
00:15:27.230 --> 00:15:28.210
- intra perspective
409
00:15:29.070 --> 00:15:30.049
- in terms of
410
00:15:30.485 --> 00:15:31.945
- what do we have today
411
00:15:32.324 --> 00:15:34.565
- and what are some of those options you
412
00:15:34.565 --> 00:15:36.084
- have. What do we have today? Like, there's
413
00:15:36.084 --> 00:15:37.684
- where we came from. So you've got the
414
00:15:37.684 --> 00:15:39.445
- worlds of passwords. All the things you use,
415
00:15:39.445 --> 00:15:40.845
- so you have to deal with passwords. So
416
00:15:40.964 --> 00:15:43.524
- Yep. Yep. Password spray attacks, all all that
417
00:15:43.524 --> 00:15:44.980
- kind of stuff. SMS,
418
00:15:45.839 --> 00:15:46.339
- MSA
419
00:15:47.120 --> 00:15:48.339
- or OTP codes,
420
00:15:48.720 --> 00:15:51.059
- things like that. You've had authenticator
421
00:15:51.600 --> 00:15:53.220
- with push notifications,
422
00:15:54.079 --> 00:15:56.079
- and then those push notifications can be as
423
00:15:56.079 --> 00:15:58.319
- simple, like, hey. I wanna come in and
424
00:15:58.319 --> 00:16:00.924
- just face ID, touch ID, whatever apps we
425
00:16:00.924 --> 00:16:02.464
- have on your platform of choice,
426
00:16:03.084 --> 00:16:04.704
- or they can also
427
00:16:05.245 --> 00:16:08.464
- be, like, number entry kind kinds of things.
428
00:16:08.764 --> 00:16:10.845
- And then on top of all of those,
429
00:16:10.845 --> 00:16:13.709
- you always had things like conditional access layered
430
00:16:13.709 --> 00:16:16.669
- in as as well. So that's kind of
431
00:16:16.669 --> 00:16:19.629
- the world we're coming from. And then where
432
00:16:19.629 --> 00:16:21.149
- we're going to is a lot of that
433
00:16:21.149 --> 00:16:23.549
- stuff is going away. So passwords are going
434
00:16:23.549 --> 00:16:24.529
- away. SMS
435
00:16:25.070 --> 00:16:28.365
- is SMS MFA or OTP is going away.
436
00:16:28.445 --> 00:16:31.164
- So that's that that voice retirement component that
437
00:16:31.164 --> 00:16:33.725
- you talked about there and everything that comes
438
00:16:33.725 --> 00:16:35.404
- with it. So you gotta think across this
439
00:16:35.404 --> 00:16:36.945
- lens of passwords,
440
00:16:37.485 --> 00:16:38.544
- SMS and voice,
441
00:16:39.004 --> 00:16:39.504
- OTP,
442
00:16:40.205 --> 00:16:40.705
- authenticator,
443
00:16:41.325 --> 00:16:42.384
- Windows Hello.
444
00:16:42.769 --> 00:16:45.490
- You've got FIDO two keys, and you've got
445
00:16:45.490 --> 00:16:46.710
- synced pass keys.
446
00:16:47.090 --> 00:16:48.230
- You've got your
447
00:16:48.610 --> 00:16:49.110
- authenticator
448
00:16:50.049 --> 00:16:52.210
- pass keys, which are different than just regular
449
00:16:52.210 --> 00:16:54.549
- authenticator and getting, like, an OTP code,
450
00:16:54.929 --> 00:16:56.845
- out of it, things like that. And then
451
00:16:56.845 --> 00:16:58.225
- you've got your conditional
452
00:16:58.605 --> 00:17:00.924
- conditional access stuff layered in there along the
453
00:17:00.924 --> 00:17:02.365
- way. So there's a whole bunch of, like,
454
00:17:02.365 --> 00:17:04.684
- moving parts and pieces and things to think
455
00:17:04.684 --> 00:17:07.565
- about depending on where your organization is at
456
00:17:07.565 --> 00:17:10.125
- today, how your tenant's configured, all all those
457
00:17:10.125 --> 00:17:11.964
- kinds of things. Yeah. When you're going in
458
00:17:11.964 --> 00:17:14.240
- and configuring it, like, I've had to do
459
00:17:14.240 --> 00:17:16.240
- this for my own tenant. I've had to
460
00:17:16.240 --> 00:17:17.700
- do it for others, and
461
00:17:18.000 --> 00:17:19.619
- it is really thinking through
462
00:17:20.319 --> 00:17:23.220
- what do passkeys mean for your organization.
463
00:17:23.599 --> 00:17:25.140
- And I think that's where
464
00:17:25.679 --> 00:17:27.700
- some of what we've been talking about already
465
00:17:28.375 --> 00:17:30.375
- starts coming into play as before it was
466
00:17:30.375 --> 00:17:33.174
- just, okay, SMS and voice. Everybody has a
467
00:17:33.174 --> 00:17:35.095
- phone. Well, I would hope most people have
468
00:17:35.095 --> 00:17:36.615
- a phone. You can do SMS. You can
469
00:17:36.615 --> 00:17:38.714
- do voice. That's pretty easy straightforward.
470
00:17:39.095 --> 00:17:40.855
- But then when you get into the area
471
00:17:40.855 --> 00:17:43.259
- of passkeys, it's to your point.
472
00:17:43.720 --> 00:17:45.720
- Now maybe I have to do authenticator app,
473
00:17:45.720 --> 00:17:47.480
- and I've had clients where I've talked to
474
00:17:47.480 --> 00:17:49.720
- where they start getting pushback of, no. This
475
00:17:49.720 --> 00:17:51.019
- is my personal device,
476
00:17:51.480 --> 00:17:53.400
- and it is 100%
477
00:17:53.400 --> 00:17:55.559
- my personal device. I am not going to
478
00:17:55.559 --> 00:17:56.299
- put authenticator
479
00:17:56.599 --> 00:17:58.014
- on it so that
480
00:17:58.634 --> 00:18:00.414
- you could do passkeys. In the past,
481
00:18:00.794 --> 00:18:02.014
- those types of users
482
00:18:02.394 --> 00:18:04.315
- in some of these companies I've worked with,
483
00:18:04.315 --> 00:18:06.554
- they're okay with a voice caller and SMS
484
00:18:06.554 --> 00:18:08.794
- text because it's not an application. It's not
485
00:18:08.794 --> 00:18:11.034
- a business application going on to their personal
486
00:18:11.034 --> 00:18:11.534
- device.
487
00:18:11.914 --> 00:18:14.390
- So it's, okay, what do we need to
488
00:18:14.390 --> 00:18:16.250
- do if we're gonna go the
489
00:18:16.869 --> 00:18:19.049
- the mobile app route for authenticator
490
00:18:19.829 --> 00:18:22.650
- and doing synced pass keys or
491
00:18:23.029 --> 00:18:26.329
- even push notifications and number matching there? And
492
00:18:26.625 --> 00:18:28.625
- to the point of, is it going to
493
00:18:28.625 --> 00:18:30.704
- work? I've actually had it Is it going
494
00:18:30.704 --> 00:18:32.704
- to work? Is it's an important question to
495
00:18:32.704 --> 00:18:35.585
- ask Yeah. And something to definitely validate out
496
00:18:35.585 --> 00:18:37.585
- there. Right. Because you said your experience with
497
00:18:37.585 --> 00:18:40.329
- Bluetooth is, does it connect, which the whole
498
00:18:40.329 --> 00:18:42.750
- Bluetooth with passkeys is still
499
00:18:43.210 --> 00:18:45.450
- a little bizarre because it's not like you
500
00:18:45.450 --> 00:18:48.809
- have to necessarily pair the devices together. It
501
00:18:48.809 --> 00:18:50.730
- still reaches out over Bluetooth to make sure
502
00:18:50.730 --> 00:18:53.954
- you're in proximity without really doing a
503
00:18:54.414 --> 00:18:56.654
- what most people think of when they're pairing
504
00:18:56.654 --> 00:18:58.034
- a keyboard or pairing
505
00:18:58.575 --> 00:19:00.974
- AirPods or pairing a Bluetooth device. You're not
506
00:19:00.974 --> 00:19:02.974
- doing that, but it is still communicating over
507
00:19:02.974 --> 00:19:03.474
- Bluetooth,
508
00:19:03.775 --> 00:19:06.240
- which can be unpredictable. And lately, I still
509
00:19:06.240 --> 00:19:08.240
- don't know what it is. I have four
510
00:19:08.240 --> 00:19:10.400
- or five passkeys on my phone. I cannot
511
00:19:10.400 --> 00:19:12.480
- use them. I have tried them with, like,
512
00:19:12.480 --> 00:19:16.180
- three different computers. I've tried resetting the passkeys.
513
00:19:16.720 --> 00:19:19.119
- I get, like, the QR code, scan this
514
00:19:19.119 --> 00:19:21.704
- to use your passkey. I scan it, and
515
00:19:21.704 --> 00:19:23.005
- it just doesn't
516
00:19:23.545 --> 00:19:26.744
- recognize it. It never connects. And I've started
517
00:19:26.744 --> 00:19:28.904
- digging into, like, do I have something on
518
00:19:28.904 --> 00:19:32.845
- my phone that's blocking that underlying Bluetooth connection?
519
00:19:33.289 --> 00:19:35.130
- I have also seen things you can run
520
00:19:35.130 --> 00:19:36.429
- into issues with
521
00:19:36.890 --> 00:19:39.769
- VPNs. I have global secure access on some
522
00:19:39.769 --> 00:19:43.390
- of my devices. So they technically egress through
523
00:19:43.849 --> 00:19:46.409
- Microsoft's data center in Virginia, I think, when
524
00:19:46.409 --> 00:19:48.924
- I'm going over global secure access. Now my
525
00:19:48.924 --> 00:19:50.765
- phone and my computer are on two different
526
00:19:50.765 --> 00:19:52.865
- networks that look like they're in geographically
527
00:19:53.484 --> 00:19:54.705
- different locations.
528
00:19:55.484 --> 00:19:58.224
- Is that causing an issue? Do I have
529
00:19:58.684 --> 00:19:59.984
- like, there's so many
530
00:20:00.365 --> 00:20:03.369
- nuances, I feel like, that can go a
531
00:20:03.369 --> 00:20:05.390
- little bit south with passkeys
532
00:20:06.330 --> 00:20:07.470
- on mobile devices.
533
00:20:08.089 --> 00:20:10.170
- That has become a challenge for me, and
534
00:20:10.170 --> 00:20:12.330
- then it's, like, well, what are my other
535
00:20:12.330 --> 00:20:14.589
- options? Then you start thinking down
536
00:20:14.970 --> 00:20:16.214
- the YubiKey route.
537
00:20:17.335 --> 00:20:20.154
- I have different clients that have different requirements
538
00:20:20.214 --> 00:20:20.954
- for YubiKeys.
539
00:20:21.335 --> 00:20:23.734
- When you're going and setting up any of
540
00:20:23.734 --> 00:20:26.134
- these passcodes, whether it's a YubiKey or something
541
00:20:26.134 --> 00:20:28.214
- else, they all have I don't even know
542
00:20:28.214 --> 00:20:29.835
- how to pronounce it. It's the AA
543
00:20:30.134 --> 00:20:32.150
- GUID that every
544
00:20:32.450 --> 00:20:34.690
- it's not even every manufacturer. It's like every
545
00:20:34.690 --> 00:20:35.670
- different version
546
00:20:35.970 --> 00:20:37.990
- or firmware number
547
00:20:38.289 --> 00:20:41.750
- of these different things have this GUID. 1Password
548
00:20:42.130 --> 00:20:45.285
- has one, but then YubiKey has one for
549
00:20:45.345 --> 00:20:48.164
- biometric devices, for proximity devices,
550
00:20:48.465 --> 00:20:50.325
- for just plug in devices,
551
00:20:51.025 --> 00:20:51.525
- and
552
00:20:51.904 --> 00:20:52.404
- Authenticator
553
00:20:52.865 --> 00:20:54.865
- has its own. You can go in and
554
00:20:54.865 --> 00:20:58.410
- start limiting in this in my Entra environment,
555
00:20:58.710 --> 00:20:59.210
- Entra.
556
00:20:59.590 --> 00:21:01.910
- People have me saying Entra. In my Entra
557
00:21:01.910 --> 00:21:02.410
- environment,
558
00:21:02.710 --> 00:21:05.509
- it is Entra. Let's I don't different people.
559
00:21:05.509 --> 00:21:07.109
- I talk to too many people. It is
560
00:21:07.109 --> 00:21:09.109
- Entra. Let's confirm that a minute. It is
561
00:21:09.109 --> 00:21:11.994
- Entra, not intra. In your intra environment, you
562
00:21:11.994 --> 00:21:14.575
- can go configure what are these AA
563
00:21:14.955 --> 00:21:16.734
- grids that I'm going to approve.
564
00:21:17.035 --> 00:21:19.855
- I'm starting to gather a collection of YubiKeys
565
00:21:20.394 --> 00:21:22.414
- because it's like, this client
566
00:21:22.909 --> 00:21:25.390
- only has these three in there. This client
567
00:21:25.390 --> 00:21:27.890
- has this one. This client has these.
568
00:21:28.429 --> 00:21:30.450
- And now I have to start keeping track
569
00:21:30.589 --> 00:21:31.650
- from my perspective,
570
00:21:32.109 --> 00:21:34.849
- this maybe isn't your everyday user, which passkeys
571
00:21:35.150 --> 00:21:35.970
- are on which
572
00:21:36.365 --> 00:21:36.865
- YubiKeys
573
00:21:37.565 --> 00:21:39.725
- that I'm having to swap out as I'm
574
00:21:39.725 --> 00:21:41.505
- authenticating into different tenants.
575
00:21:42.045 --> 00:21:45.025
- It it very quickly becomes complicated
576
00:21:45.484 --> 00:21:48.525
- for me because of multiple tenants, but even
577
00:21:48.525 --> 00:21:50.945
- you've mentioned it with one tenant as firmware
578
00:21:51.005 --> 00:21:51.505
- updates,
579
00:21:52.319 --> 00:21:52.819
- your
580
00:21:53.119 --> 00:21:55.779
- your organization that you're working for
581
00:21:56.079 --> 00:21:56.819
- may update
582
00:21:57.359 --> 00:21:58.960
- which ones are allowed. And all of a
583
00:21:58.960 --> 00:22:01.859
- sudden, one day, just one passkey stops working
584
00:22:02.079 --> 00:22:04.305
- because they decided we're no longer gonna trust
585
00:22:04.305 --> 00:22:05.985
- that firmware. I don't know how many folks
586
00:22:05.985 --> 00:22:08.625
- leverage the a a goo with thing, but
587
00:22:08.625 --> 00:22:10.465
- if you work in an organization that does
588
00:22:10.705 --> 00:22:13.025
- I've encountered more than I thought. I wouldn't
589
00:22:13.025 --> 00:22:15.105
- think most folks would dig in that far
590
00:22:15.105 --> 00:22:17.400
- because it is kinda buried, like, down in
591
00:22:17.400 --> 00:22:19.740
- in the depths of FIDO key configuration
592
00:22:20.359 --> 00:22:21.080
- inside of,
593
00:22:21.720 --> 00:22:24.440
- Entre there, but it's a rotating game. So
594
00:22:24.440 --> 00:22:27.180
- I know for me, I have a stack
595
00:22:27.480 --> 00:22:30.119
- of YubiKeys at home right now. Like, I
596
00:22:30.119 --> 00:22:31.400
- just keep them all on my desk on
597
00:22:31.400 --> 00:22:32.975
- the side, like, because I can keep using
598
00:22:32.975 --> 00:22:34.975
- them for other things if I wipe them.
599
00:22:34.975 --> 00:22:36.995
- So I can use them for my Gmail
600
00:22:37.695 --> 00:22:40.995
- and my regular, like, Microsoft account, my MSA,
601
00:22:41.055 --> 00:22:43.375
- my consumer account, things like that. But for
602
00:22:43.375 --> 00:22:46.779
- my organizational account, I'm on this constant train
603
00:22:46.779 --> 00:22:49.339
- of, like, bumping YubiKeys because I have to
604
00:22:49.339 --> 00:22:52.079
- go to new versions of new YubiKeys because
605
00:22:52.139 --> 00:22:53.359
- they have updated firmware,
606
00:22:54.220 --> 00:22:55.519
- which probably prevent
607
00:22:55.980 --> 00:22:57.119
- security concerns
608
00:22:57.704 --> 00:22:59.865
- and have patches and blah blah. Bunch of
609
00:22:59.865 --> 00:23:01.704
- stuff that I've never seen published anywhere. I
610
00:23:01.704 --> 00:23:03.944
- don't know if, like, YubiKey or Yubico or
611
00:23:03.944 --> 00:23:05.964
- or folks publish those kinds of things. But
612
00:23:06.105 --> 00:23:08.204
- I'm on this constant march of
613
00:23:08.664 --> 00:23:10.984
- always having to figure out, like, is this
614
00:23:10.984 --> 00:23:13.065
- the right YubiKey? Because they all look the
615
00:23:13.065 --> 00:23:15.139
- same, but they all have different capabilities.
616
00:23:15.919 --> 00:23:17.359
- And then does it have, like, the right
617
00:23:17.359 --> 00:23:19.759
- set of identities on it, which you can't
618
00:23:19.759 --> 00:23:21.759
- really tell on a YubiKey. Right? You kinda
619
00:23:21.759 --> 00:23:22.960
- have to put it in and try it.
620
00:23:22.960 --> 00:23:24.799
- There's no, like, YubiKey app that you just
621
00:23:24.799 --> 00:23:26.879
- load up, and it says, oh, here's all
622
00:23:26.879 --> 00:23:29.474
- the here's all the identities that are bound
623
00:23:29.474 --> 00:23:31.075
- to this thing. So they don't make it,
624
00:23:31.075 --> 00:23:32.295
- like, very easy.
625
00:23:32.994 --> 00:23:33.654
- And organizationally,
626
00:23:34.035 --> 00:23:36.115
- if, like, you're on like, everybody's on the
627
00:23:36.115 --> 00:23:38.035
- same version of a YubiKey and then you
628
00:23:38.035 --> 00:23:39.795
- have to plan for this. Right? So let's
629
00:23:39.795 --> 00:23:42.434
- say you're a thousand person organization and all
630
00:23:42.434 --> 00:23:44.830
- of a sudden, everybody's on YubiKeys. Great. So
631
00:23:44.830 --> 00:23:46.830
- you go buy a thousand YubiKeys, you bulk
632
00:23:46.830 --> 00:23:49.090
- price whatever. What happens when
633
00:23:49.789 --> 00:23:51.009
- those were on firmware
634
00:23:51.549 --> 00:23:53.630
- five dot four, and now you've gotta get
635
00:23:53.630 --> 00:23:55.549
- everybody to a new AA GUID and up
636
00:23:55.549 --> 00:23:56.130
- to firmware
637
00:23:56.590 --> 00:23:58.674
- five dot seven or whatever it happens to
638
00:23:58.674 --> 00:24:00.595
- be. Well, guess what? You need to go
639
00:24:00.595 --> 00:24:03.475
- buy a thousand new YubiKeys. You need to
640
00:24:03.475 --> 00:24:06.115
- send out those YubiKeys to your users, and
641
00:24:06.115 --> 00:24:07.494
- then you have to have your users
642
00:24:07.795 --> 00:24:09.174
- bind a new
643
00:24:09.555 --> 00:24:12.419
- YubiKey to their account and then stop using
644
00:24:12.419 --> 00:24:14.339
- their old YubiKey. And, like, what do you
645
00:24:14.339 --> 00:24:16.279
- do with that? Well, it's just e waste
646
00:24:16.579 --> 00:24:18.679
- and and other things that are out there.
647
00:24:18.900 --> 00:24:20.919
- And so so, yeah, it's this whole weird
648
00:24:21.059 --> 00:24:23.299
- kinda kinda matrix that you have to walk
649
00:24:23.299 --> 00:24:26.339
- through, and it quickly turns into, I think,
650
00:24:26.339 --> 00:24:28.375
- like, what I would just call a quagmire.
651
00:24:28.755 --> 00:24:29.255
- Like,
652
00:24:29.634 --> 00:24:32.355
- it's it's hard to navigate, and it's hard
653
00:24:32.355 --> 00:24:32.855
- to
654
00:24:33.394 --> 00:24:35.634
- it's hard to think through. Like, I I
655
00:24:35.634 --> 00:24:38.375
- really struggle thinking back to, like, some of
656
00:24:38.595 --> 00:24:40.900
- the several thousand person, like, m three sixty
657
00:24:40.900 --> 00:24:43.320
- five environments that I've managed in the past
658
00:24:43.620 --> 00:24:45.320
- about transitioning those organizations
659
00:24:45.620 --> 00:24:47.400
- over to something like authenticator
660
00:24:47.779 --> 00:24:49.000
- bound pass keys.
661
00:24:49.460 --> 00:24:51.585
- Like, oh my gosh. Like, what a
662
00:24:52.224 --> 00:24:54.625
- what a nightmare scenario that is. I'd rather
663
00:24:54.625 --> 00:24:55.365
- do, like,
664
00:24:55.744 --> 00:24:57.904
- a a a 5,000 seat, like, office upgrade
665
00:24:57.904 --> 00:24:59.904
- or an exchange upgrade or something like that
666
00:24:59.904 --> 00:25:02.544
- or a a SharePoint farm upgrade than than
667
00:25:02.544 --> 00:25:04.784
- go through and push that one. Yeah. Because
668
00:25:04.784 --> 00:25:06.200
- it is. It's hard. Right? You're going away
669
00:25:06.200 --> 00:25:07.820
- from maybe, like, something like YubiKey
670
00:25:08.359 --> 00:25:10.600
- or a CAC card or something else that
671
00:25:10.600 --> 00:25:12.359
- you had out there, and then you're binding
672
00:25:12.359 --> 00:25:15.480
- it to a a mobile device. Like and
673
00:25:15.480 --> 00:25:17.000
- like you said, like, I I think some
674
00:25:17.000 --> 00:25:19.080
- people do have a big hesitation around my
675
00:25:19.080 --> 00:25:21.305
- personal device coming in, and they're like, does
676
00:25:21.305 --> 00:25:23.244
- my personal device now need to be MDM'd?
677
00:25:23.464 --> 00:25:26.105
- Well, how hard? You know? Does it need
678
00:25:26.105 --> 00:25:28.025
- to be MDM, and what does that follow
679
00:25:28.025 --> 00:25:29.865
- along with? So there there's a whole bunch
680
00:25:29.865 --> 00:25:32.025
- of considerations out there on, like, the hardware
681
00:25:32.025 --> 00:25:33.865
- side and the procurement side and the life
682
00:25:33.865 --> 00:25:37.250
- cycle side that add to the cost
683
00:25:37.630 --> 00:25:39.650
- of something like passwordless
684
00:25:40.589 --> 00:25:41.089
- authentication
685
00:25:41.710 --> 00:25:42.210
- with
686
00:25:42.509 --> 00:25:44.210
- with passkeys like this.
687
00:25:45.710 --> 00:25:48.674
- If you're managing file storage today, you've probably
688
00:25:48.674 --> 00:25:51.474
- felt the pressure. Refresh cycles are harder to
689
00:25:51.474 --> 00:25:54.914
- plan, costs and complexity are increasing, especially as
690
00:25:54.914 --> 00:25:57.014
- file workloads scale across regions.
691
00:25:57.315 --> 00:26:00.630
- That's why Microsoft customers trust Nasuni. As an
692
00:26:00.789 --> 00:26:02.250
- Azure certified software,
693
00:26:02.630 --> 00:26:05.589
- Nasuni provides a global file system designed for
694
00:26:05.589 --> 00:26:06.970
- enterprise scale environments,
695
00:26:07.349 --> 00:26:10.789
- keeping file data secure, governed, and accessible across
696
00:26:10.789 --> 00:26:13.849
- Azure environments without added infrastructure complexity.
697
00:26:14.325 --> 00:26:15.224
- It's the foundation
698
00:26:15.605 --> 00:26:18.565
- to keep your unstructured data stable even as
699
00:26:18.565 --> 00:26:21.365
- your infrastructure evolves. To see how much you
700
00:26:21.365 --> 00:26:24.005
- could save while keeping your initiatives on track,
701
00:26:24.005 --> 00:26:28.140
- visit nasuni.com/tco.
702
00:26:28.380 --> 00:26:33.039
- That's nasuni.com/tco.
703
00:26:34.220 --> 00:26:37.579
- Microsoft is trying to help with this. I
704
00:26:37.579 --> 00:26:39.660
- would say it's better than it was three
705
00:26:39.660 --> 00:26:41.579
- months ago. I had one company that switched
706
00:26:41.579 --> 00:26:44.465
- to passkeys three months ago, and it was
707
00:26:44.465 --> 00:26:46.644
- three ish months ago. We sent out instructions.
708
00:26:46.785 --> 00:26:48.945
- Right? Like, go install your authenticator app. Go
709
00:26:48.945 --> 00:26:51.205
- in here. Click on passkeys. Add a passkey.
710
00:26:51.664 --> 00:26:53.664
- Walk them through everything. This was only, like,
711
00:26:53.664 --> 00:26:55.559
- six or seven people. And we were like,
712
00:26:55.640 --> 00:26:57.559
- on this date, you're gonna have to use
713
00:26:57.559 --> 00:27:00.220
- your passkey. We're flipping over conditional access.
714
00:27:00.600 --> 00:27:02.920
- Passkeys are gonna be required. We flipped it
715
00:27:02.920 --> 00:27:06.059
- over and, like, 50% of the 10 people,
716
00:27:06.200 --> 00:27:07.799
- I can't get into my account. It's telling
717
00:27:07.799 --> 00:27:09.019
- me I don't have a passkey.
718
00:27:09.400 --> 00:27:10.759
- Get on the phone with them. Well, did
719
00:27:10.759 --> 00:27:12.174
- you go do this? No. I just had
720
00:27:12.174 --> 00:27:14.015
- authenticator on there, and I was getting push
721
00:27:14.015 --> 00:27:16.015
- notifications and number matching, and I thought that
722
00:27:16.015 --> 00:27:16.835
- was good enough.
723
00:27:17.295 --> 00:27:18.974
- No. You actually have to go register a
724
00:27:18.974 --> 00:27:21.215
- passkey. So and that was only 10 people
725
00:27:21.215 --> 00:27:23.055
- to your point. I can't imagine trying to
726
00:27:23.055 --> 00:27:25.075
- go through that with a 2,000.
727
00:27:25.455 --> 00:27:27.889
- As of July 1,
728
00:27:28.190 --> 00:27:29.889
- I believe this came out or June,
729
00:27:30.190 --> 00:27:30.690
- Microsoft
730
00:27:31.149 --> 00:27:32.909
- at least rolled out a way now to
731
00:27:32.909 --> 00:27:33.649
- do a registration
732
00:27:33.950 --> 00:27:36.269
- campaign in Entra Yep. To set up a
733
00:27:36.269 --> 00:27:36.769
- passkey.
734
00:27:37.230 --> 00:27:38.049
- So this
735
00:27:38.349 --> 00:27:39.409
- does support
736
00:27:39.775 --> 00:27:40.275
- passkeys
737
00:27:40.894 --> 00:27:43.154
- FIDO two to register a passkey,
738
00:27:43.615 --> 00:27:45.934
- whether it be synced, which is going to
739
00:27:45.934 --> 00:27:48.494
- be your authenticator one. I'm still waiting for
740
00:27:48.494 --> 00:27:51.214
- synced in one password. Probably, I'm not gonna
741
00:27:51.214 --> 00:27:53.009
- hold my breath for that one. Or the
742
00:27:53.009 --> 00:27:55.490
- device bound If it comes, please tell me.
743
00:27:55.490 --> 00:27:57.650
- Like Yeah. I will keep you updated. Or,
744
00:27:57.650 --> 00:27:59.590
- like, the device bound, your Ubiquys
745
00:28:00.450 --> 00:28:00.950
- Authenticator
746
00:28:01.809 --> 00:28:02.309
- also
747
00:28:02.690 --> 00:28:04.869
- has an option of device bound, I think.
748
00:28:05.009 --> 00:28:07.494
- But it at least has that campaign there
749
00:28:07.494 --> 00:28:09.515
- now, so you can go turn these on
750
00:28:09.654 --> 00:28:12.295
- and actually walk people through setting up pass
751
00:28:12.295 --> 00:28:14.775
- keys versus just it's on or off. Which
752
00:28:14.775 --> 00:28:17.335
- is helpful for existing accounts. I think you
753
00:28:17.335 --> 00:28:18.855
- still need to think about, like, the new
754
00:28:18.855 --> 00:28:21.089
- user flow and things like that. So, like,
755
00:28:21.569 --> 00:28:23.650
- how do you onboard your users in a
756
00:28:23.650 --> 00:28:26.130
- world where there are no passwords and you
757
00:28:26.130 --> 00:28:28.130
- need to get them a passkey and things
758
00:28:28.130 --> 00:28:28.789
- like that?
759
00:28:29.089 --> 00:28:30.950
- That's an interesting one
760
00:28:31.250 --> 00:28:33.890
- too. I I haven't seen a bunch out
761
00:28:33.890 --> 00:28:35.029
- there about the way organizations
762
00:28:35.490 --> 00:28:37.585
- are handling that kind of thing, but it's
763
00:28:37.585 --> 00:28:40.545
- not, like, well covered in, like, Microsoft land
764
00:28:40.545 --> 00:28:43.125
- either. No. I'm working on this for another
765
00:28:43.424 --> 00:28:43.924
- client.
766
00:28:44.304 --> 00:28:47.285
- It is possible because I've had customers
767
00:28:47.744 --> 00:28:49.904
- onboard me through it. Granted, it was like
768
00:28:49.904 --> 00:28:51.525
- a 20 page Word document
769
00:28:51.869 --> 00:28:54.289
- step by step with screenshots because it's not
770
00:28:54.349 --> 00:28:57.630
- straightforward because it involves a temporary access pass
771
00:28:57.630 --> 00:29:00.829
- and the registration, all that. I would love
772
00:29:00.829 --> 00:29:03.490
- this to see this get better both from
773
00:29:03.630 --> 00:29:05.869
- what you said. How do you onboard users
774
00:29:05.869 --> 00:29:06.369
- initially?
775
00:29:06.755 --> 00:29:09.634
- But even these registration campaigns, it's pretty much
776
00:29:09.634 --> 00:29:11.715
- like go turn it on and force people
777
00:29:11.715 --> 00:29:12.615
- to do a passkey.
778
00:29:12.994 --> 00:29:15.075
- It doesn't give you a lot of control.
779
00:29:15.075 --> 00:29:17.955
- Like, do I want to walk people through
780
00:29:17.955 --> 00:29:18.535
- a registration
781
00:29:18.835 --> 00:29:20.855
- campaign to use a
782
00:29:21.599 --> 00:29:24.319
- USB device, or do I want them to
783
00:29:24.319 --> 00:29:25.299
- go to authenticator?
784
00:29:26.240 --> 00:29:28.720
- I'm hoping we see more come with these
785
00:29:28.720 --> 00:29:29.220
- registration
786
00:29:29.519 --> 00:29:30.019
- campaigns
787
00:29:30.559 --> 00:29:32.400
- to set up pass keys to be able
788
00:29:32.400 --> 00:29:35.619
- to better control it and guide people
789
00:29:36.000 --> 00:29:39.255
- through the right path or set which path
790
00:29:39.255 --> 00:29:41.335
- you want people to take. This is also
791
00:29:41.335 --> 00:29:42.534
- hard. I don't know if you've had this.
792
00:29:42.534 --> 00:29:43.815
- Have you ever gone to set up a
793
00:29:43.815 --> 00:29:46.454
- passkey and one password always wants to take
794
00:29:46.454 --> 00:29:48.214
- over even if you collect that it's a
795
00:29:48.214 --> 00:29:50.230
- USB passkey, and then you have to go
796
00:29:50.230 --> 00:29:52.549
- in and say use a different USB device,
797
00:29:52.549 --> 00:29:54.630
- and instead of one password, select your FIDO
798
00:29:54.630 --> 00:29:58.309
- key. It's things like that I feel like
799
00:29:58.309 --> 00:30:00.009
- from an end user perspective
800
00:30:00.630 --> 00:30:02.734
- need to get a lot smoother or I
801
00:30:02.734 --> 00:30:04.494
- want to see get a lot smoother for
802
00:30:04.494 --> 00:30:05.794
- this whole registration
803
00:30:06.654 --> 00:30:08.734
- process. I think it's a loaded thing right
804
00:30:08.734 --> 00:30:09.634
- now. So,
805
00:30:10.174 --> 00:30:11.454
- like I said, I would like to see
806
00:30:11.454 --> 00:30:14.174
- Microsoft be more open. So don't bind me
807
00:30:14.174 --> 00:30:15.154
- to Authenticator.
808
00:30:15.649 --> 00:30:17.089
- And when I say don't bind me to
809
00:30:17.089 --> 00:30:19.409
- Authenticator, I mean, not Authenticator Authenticator, but I
810
00:30:19.409 --> 00:30:22.309
- mean Authenticator with a passkey, which is a
811
00:30:22.529 --> 00:30:24.049
- a different mode that's in there. Like, it
812
00:30:24.049 --> 00:30:26.210
- makes it super confusing to talk about. So
813
00:30:26.210 --> 00:30:27.730
- some of this other stuff, like like, one
814
00:30:27.730 --> 00:30:30.470
- password maybe, like, conflicting with, like, a browser
815
00:30:30.769 --> 00:30:32.835
- versus something else. Like, I think that just
816
00:30:32.835 --> 00:30:34.055
- speaks to, like, the ecosystems
817
00:30:34.434 --> 00:30:36.674
- all over the place. Like, does Microsoft really
818
00:30:36.674 --> 00:30:38.434
- have to care about one password? I don't
819
00:30:38.434 --> 00:30:39.654
- I don't know if they should,
820
00:30:39.955 --> 00:30:41.474
- but I think they should care about being,
821
00:30:41.474 --> 00:30:42.855
- like, open in the ecosystem
822
00:30:43.555 --> 00:30:44.295
- and kinda
823
00:30:44.720 --> 00:30:47.039
- meeting customers in the middle where they want
824
00:30:47.039 --> 00:30:49.279
- to be because there are customers out there
825
00:30:49.279 --> 00:30:52.240
- that and I've seen, like, enterprises that use
826
00:30:52.240 --> 00:30:52.900
- one password
827
00:30:53.680 --> 00:30:56.640
- for management of these kinds of things. And
828
00:30:56.640 --> 00:30:58.559
- they make it out there, and they license
829
00:30:58.559 --> 00:31:00.974
- it for their users. So think Microsoft should
830
00:31:00.974 --> 00:31:03.375
- be maybe, like, a little bit more open
831
00:31:03.375 --> 00:31:04.835
- in open in that space.
832
00:31:05.134 --> 00:31:07.075
- I would love to see updates to
833
00:31:07.454 --> 00:31:10.815
- the registration campaign stuff. So to your point,
834
00:31:10.815 --> 00:31:12.335
- like, I think one of the biggest things
835
00:31:12.335 --> 00:31:15.179
- with passkeys is training and user enablement. Like,
836
00:31:15.179 --> 00:31:16.859
- you do have to spend time there and
837
00:31:16.859 --> 00:31:18.619
- train your users. I don't think you can
838
00:31:18.619 --> 00:31:21.339
- just expect that everybody's gonna grok it and
839
00:31:21.339 --> 00:31:23.339
- pick it up. But, like, those registration campaigns
840
00:31:23.339 --> 00:31:25.019
- don't give you a lot of flexibility. Like,
841
00:31:25.019 --> 00:31:26.220
- sure, I can go out and create this
842
00:31:26.220 --> 00:31:27.845
- thing, but all it's gonna do is hound
843
00:31:27.845 --> 00:31:30.004
- my user to go ahead and create MFA
844
00:31:30.004 --> 00:31:32.884
- and get a passkey or the authenticator enablement
845
00:31:32.884 --> 00:31:35.204
- if you're doing that. And that's kinda it.
846
00:31:35.204 --> 00:31:37.204
- Like, you'd really want the ability to, like,
847
00:31:37.204 --> 00:31:39.304
- add a help link here. Like, just, like,
848
00:31:39.365 --> 00:31:41.684
- click this link to learn more and maybe
849
00:31:41.684 --> 00:31:44.160
- go over to, like, your custom learning system
850
00:31:44.539 --> 00:31:45.759
- or your documentation,
851
00:31:46.779 --> 00:31:48.000
- things like that. Because
852
00:31:48.380 --> 00:31:50.539
- to your point, it could be a 20
853
00:31:50.539 --> 00:31:52.779
- page PDF or a 20 page Word doc
854
00:31:52.779 --> 00:31:55.100
- for onboarding. But I guarantee it's usually a
855
00:31:55.100 --> 00:31:57.144
- couple pages at least, like, four or five
856
00:31:57.144 --> 00:31:58.904
- men by the time you put some screenshots
857
00:31:58.904 --> 00:32:01.065
- and stuff in there to get folks to
858
00:32:01.065 --> 00:32:02.105
- to where they need to be. So I
859
00:32:02.105 --> 00:32:03.484
- think, like, having that,
860
00:32:03.945 --> 00:32:07.625
- Microsoft should probably go and provide some additional,
861
00:32:07.625 --> 00:32:08.984
- like I don't actually know what they do.
862
00:32:08.984 --> 00:32:10.049
- I didn't see this. Like, you know how
863
00:32:10.049 --> 00:32:12.870
- they provide, like, the onboarding campaigns for SharePoint
864
00:32:13.009 --> 00:32:15.769
- and Outlook and Exchange Online, all those kinds
865
00:32:15.769 --> 00:32:18.070
- of things? I've never seen one for
866
00:32:19.009 --> 00:32:22.289
- MFA, like, like, an enablement campaign thing. Like,
867
00:32:22.289 --> 00:32:23.350
- like, the word templates
868
00:32:23.730 --> 00:32:26.465
- and everything that's out there. So, yeah, you're
869
00:32:26.465 --> 00:32:28.565
- largely left to your own in this space,
870
00:32:29.025 --> 00:32:31.904
- which is it's just a a weird one
871
00:32:31.904 --> 00:32:33.025
- for the way it sits out there. And
872
00:32:33.025 --> 00:32:35.205
- I think the lift for customers
873
00:32:35.744 --> 00:32:37.845
- and the folks who are admins and operators
874
00:32:37.985 --> 00:32:38.884
- of these environments
875
00:32:39.539 --> 00:32:41.380
- and what they need to do there. I
876
00:32:41.380 --> 00:32:43.799
- think, hope, this is going to be coming
877
00:32:44.340 --> 00:32:45.400
- faster and faster.
878
00:32:45.860 --> 00:32:47.860
- Where it's gonna be pass keys It's gonna
879
00:32:47.860 --> 00:32:50.420
- keep barreling down. Yeah. There's there's I'm actually
880
00:32:50.420 --> 00:32:52.600
- surprised this is the one area I'm surprised
881
00:32:52.984 --> 00:32:54.845
- still uses SMS for everything
882
00:32:55.144 --> 00:32:55.644
- is,
883
00:32:56.105 --> 00:32:58.445
- by and large, all of my banks
884
00:32:58.904 --> 00:33:00.125
- still use SMS
885
00:33:00.664 --> 00:33:01.164
- for
886
00:33:01.545 --> 00:33:02.045
- authentication.
887
00:33:02.744 --> 00:33:04.424
- And the reason I say this is coming
888
00:33:04.424 --> 00:33:06.399
- faster and faster, I have
889
00:33:06.779 --> 00:33:08.779
- seen with AI. AI is really good at
890
00:33:08.779 --> 00:33:11.119
- writing by and large. The phishing
891
00:33:11.500 --> 00:33:12.000
- emails
892
00:33:12.380 --> 00:33:13.519
- and the phishing
893
00:33:13.819 --> 00:33:14.319
- attacks
894
00:33:14.940 --> 00:33:17.440
- that I have started seeing, certain
895
00:33:17.740 --> 00:33:20.159
- things you used to look for in emails
896
00:33:20.524 --> 00:33:21.825
- to know that it was phishing
897
00:33:22.365 --> 00:33:24.224
- in, again, SMS, voice,
898
00:33:25.005 --> 00:33:27.585
- OTP, all of these are very phishing vulnerable.
899
00:33:27.964 --> 00:33:30.204
- And even voice calling with what AI can
900
00:33:30.204 --> 00:33:32.444
- do with voice mail and replicating someone else's
901
00:33:32.444 --> 00:33:35.105
- voice. Only takes about ten seconds, fifteen seconds
902
00:33:35.244 --> 00:33:38.029
- from a clip. It's kinda wild. You're gonna
903
00:33:38.029 --> 00:33:40.430
- have to move someone can replicate both of
904
00:33:40.430 --> 00:33:42.190
- us, Scott, from our podcast. Take all of
905
00:33:42.190 --> 00:33:44.830
- our podcast episodes and create the virtual Ben
906
00:33:44.830 --> 00:33:47.470
- and Scott. Pass keys are going to have
907
00:33:47.470 --> 00:33:49.525
- to be there to prevent some of these
908
00:33:49.525 --> 00:33:52.565
- phishing because phishing things like OTP and SMS
909
00:33:52.565 --> 00:33:55.125
- and voice is going to get easier and
910
00:33:55.125 --> 00:33:57.924
- easier, I think, at an exponential pace with
911
00:33:57.924 --> 00:33:59.924
- the way technology and AI and all of
912
00:33:59.924 --> 00:34:01.785
- that are going. This brings up an interesting
913
00:34:01.845 --> 00:34:02.825
- question. So
914
00:34:03.130 --> 00:34:05.289
- in the world of these things are changing
915
00:34:05.289 --> 00:34:05.789
- rapidly,
916
00:34:06.169 --> 00:34:08.489
- and there's kind of a clear road map
917
00:34:08.489 --> 00:34:10.090
- at least from the m three sixty five
918
00:34:10.090 --> 00:34:12.650
- entry ID side to say, hey. Let's get
919
00:34:12.650 --> 00:34:13.630
- from kinda
920
00:34:13.929 --> 00:34:16.525
- x to y or a to b as
921
00:34:16.525 --> 00:34:17.105
- a destination
922
00:34:17.644 --> 00:34:19.184
- kind of thing is
923
00:34:20.204 --> 00:34:22.445
- when you're going down and you're enabling all
924
00:34:22.445 --> 00:34:23.264
- these things,
925
00:34:23.644 --> 00:34:24.144
- is
926
00:34:24.445 --> 00:34:26.704
- how do you think about backup credentials?
927
00:34:27.164 --> 00:34:29.405
- And because you can have multiple modes of
928
00:34:29.405 --> 00:34:29.905
- authentication
929
00:34:30.284 --> 00:34:32.840
- today. Like, the goal is passwordless,
930
00:34:33.460 --> 00:34:35.140
- but you have all these other click stops
931
00:34:35.140 --> 00:34:36.660
- and maybe these things that you're using out
932
00:34:36.660 --> 00:34:39.140
- there today, and they become legitimate backups. Right?
933
00:34:39.140 --> 00:34:40.280
- If I'm really struggling
934
00:34:40.660 --> 00:34:42.760
- with my passwordless authentication
935
00:34:43.780 --> 00:34:45.539
- and passkey, like, do you give me a
936
00:34:45.539 --> 00:34:48.684
- fallback and let me go to OTP or
937
00:34:48.684 --> 00:34:49.184
- voice
938
00:34:49.565 --> 00:34:51.644
- or something else for a little bit little
939
00:34:51.644 --> 00:34:54.445
- while? So how many backup credentials do you
940
00:34:54.445 --> 00:34:56.304
- think, like, folks
941
00:34:56.605 --> 00:34:57.505
- should have
942
00:34:57.804 --> 00:34:58.625
- in an organization
943
00:34:59.005 --> 00:35:01.485
- generally? And then how many backup credentials do
944
00:35:01.485 --> 00:35:04.500
- you think admins or, like, privileged operators should
945
00:35:04.500 --> 00:35:05.559
- have? And
946
00:35:06.019 --> 00:35:07.220
- at some point, you're gonna have to think
947
00:35:07.220 --> 00:35:09.940
- about disabling those. Right? So how many backup
948
00:35:09.940 --> 00:35:11.000
- credentials should
949
00:35:11.300 --> 00:35:13.960
- admins, privileged operators have versus regular users
950
00:35:14.355 --> 00:35:17.735
- before you're comfortable going ahead and, like, disabling
951
00:35:17.795 --> 00:35:19.175
- some of those weaker methods,
952
00:35:19.474 --> 00:35:20.675
- things that are out there? I'm trying to
953
00:35:20.675 --> 00:35:22.295
- think over the last several months
954
00:35:22.594 --> 00:35:25.235
- when I've had to go in and get
955
00:35:25.235 --> 00:35:26.454
- into different environments.
956
00:35:27.150 --> 00:35:27.889
- I think
957
00:35:28.429 --> 00:35:30.510
- based on the last several months or even
958
00:35:30.510 --> 00:35:31.010
- years,
959
00:35:31.389 --> 00:35:33.389
- I think you could do two. One backup
960
00:35:33.389 --> 00:35:35.710
- method and a primary. I think you could
961
00:35:35.710 --> 00:35:36.589
- get away with
962
00:35:37.150 --> 00:35:37.889
- and this
963
00:35:38.269 --> 00:35:41.089
- you could define the nuances here of backups.
964
00:35:41.405 --> 00:35:42.224
- I would go
965
00:35:42.525 --> 00:35:43.824
- with one passkey,
966
00:35:44.125 --> 00:35:45.824
- and this is where it's a nuance is.
967
00:35:45.885 --> 00:35:48.464
- Do you count one method as having, like,
968
00:35:48.605 --> 00:35:51.244
- two different UB keys and a passkey and
969
00:35:51.244 --> 00:35:51.744
- authenticator?
970
00:35:52.204 --> 00:35:54.125
- Does that count as just passkey, or is
971
00:35:54.125 --> 00:35:57.239
- that technically three different ways? And then I
972
00:35:57.239 --> 00:35:59.340
- still have fallen back to
973
00:35:59.640 --> 00:36:00.699
- something in authenticator,
974
00:36:01.000 --> 00:36:02.780
- whether it's a push number matching.
975
00:36:03.239 --> 00:36:05.239
- There have been a couple times where I've
976
00:36:05.239 --> 00:36:07.019
- had to fall back to an OTP
977
00:36:07.320 --> 00:36:08.840
- where I go to try to log in
978
00:36:08.840 --> 00:36:11.154
- to Entra, and it says, we couldn't send
979
00:36:11.154 --> 00:36:13.394
- you a push notification right now. And I've
980
00:36:13.394 --> 00:36:15.574
- had to go back to that OTP route
981
00:36:15.714 --> 00:36:17.414
- using a code and authenticator,
982
00:36:17.954 --> 00:36:20.275
- or I will do some OTP codes in
983
00:36:20.275 --> 00:36:21.014
- one password.
984
00:36:21.554 --> 00:36:23.074
- So I think that's where I would fall
985
00:36:23.074 --> 00:36:24.855
- out as maybe something in authenticator,
986
00:36:25.500 --> 00:36:27.280
- whether a push or an OTP,
987
00:36:27.659 --> 00:36:28.159
- and
988
00:36:28.539 --> 00:36:30.800
- I would probably say multiple passkeys.
989
00:36:31.260 --> 00:36:33.900
- One of them not being an authenticator, having
990
00:36:33.900 --> 00:36:34.559
- a physical
991
00:36:35.179 --> 00:36:35.679
- hardware
992
00:36:36.380 --> 00:36:37.394
- passkey, partly
993
00:36:38.355 --> 00:36:39.954
- challenges I have had with some of the
994
00:36:39.954 --> 00:36:41.795
- passkeys in Authenticator. I think you have to
995
00:36:41.795 --> 00:36:43.315
- do it. Like, it's kinda like the three
996
00:36:43.315 --> 00:36:45.015
- two one backup method thing.
997
00:36:46.275 --> 00:36:48.695
- And putting all your eggs in the Authenticator
998
00:36:48.755 --> 00:36:51.869
- basket is kinda hard, whether it's passkey
999
00:36:52.730 --> 00:36:54.030
- or it's OTP
1000
00:36:54.329 --> 00:36:54.989
- through authenticator
1001
00:36:56.170 --> 00:36:57.469
- or, like, push notification
1002
00:36:57.929 --> 00:37:00.250
- with a number, things like that. Because, like,
1003
00:37:00.250 --> 00:37:02.890
- one, what if the authenticator app is broken
1004
00:37:02.890 --> 00:37:05.114
- today, which could happen along the way. Like,
1005
00:37:05.114 --> 00:37:06.554
- who knows? Like you said, you can't get
1006
00:37:06.554 --> 00:37:07.454
- push notifications
1007
00:37:07.914 --> 00:37:09.515
- or and that could be a failure on
1008
00:37:09.515 --> 00:37:10.574
- Microsoft side,
1009
00:37:10.954 --> 00:37:12.635
- could be a failure on the app side,
1010
00:37:12.635 --> 00:37:15.035
- could be a connectivity thing, all all that.
1011
00:37:15.035 --> 00:37:16.474
- So I think you have to have something
1012
00:37:16.474 --> 00:37:17.914
- else to assess out of this. So whether
1013
00:37:17.914 --> 00:37:18.449
- that's, like,
1014
00:37:19.250 --> 00:37:21.349
- device bound, like a FIDO two key
1015
00:37:21.650 --> 00:37:22.150
- sitting,
1016
00:37:22.449 --> 00:37:24.609
- like, there at your desk, which, yeah, maybe
1017
00:37:24.609 --> 00:37:25.829
- that's got, like, a different,
1018
00:37:26.130 --> 00:37:27.730
- like, token time out, and you have to
1019
00:37:27.730 --> 00:37:29.489
- reauthenticate more. But at least you can get
1020
00:37:29.489 --> 00:37:31.664
- into the environment, and you can do things
1021
00:37:31.664 --> 00:37:34.385
- that's that that's an important one. I do
1022
00:37:34.385 --> 00:37:36.785
- think there's less value in the world of
1023
00:37:36.785 --> 00:37:38.485
- things like voice,
1024
00:37:38.785 --> 00:37:41.105
- SMS, all that. Like, if you're gonna go
1025
00:37:41.105 --> 00:37:42.785
- and say, like, hey. 321
1026
00:37:42.785 --> 00:37:43.285
- is
1027
00:37:43.590 --> 00:37:44.090
- password
1028
00:37:44.390 --> 00:37:47.430
- passkey on authenticator plus OTP on authenticator plus
1029
00:37:47.430 --> 00:37:49.510
- a FIDO key, I think that kinda gets
1030
00:37:49.510 --> 00:37:50.170
- you there.
1031
00:37:50.470 --> 00:37:50.970
- SMS,
1032
00:37:51.510 --> 00:37:52.489
- you're probably
1033
00:37:52.789 --> 00:37:54.410
- for what? Like, 99
1034
00:37:54.630 --> 00:37:57.195
- plus percent of the time, SMSing the same
1035
00:37:57.195 --> 00:37:58.175
- phone that authenticator
1036
00:37:58.474 --> 00:38:01.035
- is already on. So or same thing with
1037
00:38:01.035 --> 00:38:03.755
- voice. You're calling at usually the same number,
1038
00:38:03.755 --> 00:38:05.355
- things like that. So I don't think you
1039
00:38:05.355 --> 00:38:07.434
- have to go down that path, and maybe
1040
00:38:07.434 --> 00:38:08.875
- that helps you. Like, if you do go
1041
00:38:08.875 --> 00:38:10.175
- start transitioning users
1042
00:38:10.474 --> 00:38:12.000
- and getting them over, you can at least
1043
00:38:12.000 --> 00:38:14.159
- get them used to the authenticator app for
1044
00:38:14.159 --> 00:38:16.320
- all the foibles that it has. But at
1045
00:38:16.320 --> 00:38:17.679
- least get them used to it and then
1046
00:38:17.679 --> 00:38:20.800
- give them some kind of backup method outside
1047
00:38:20.800 --> 00:38:22.880
- of that. Ideally, in, like, a FIDO two
1048
00:38:22.880 --> 00:38:25.119
- key, but then I think you do have
1049
00:38:25.119 --> 00:38:27.005
- to weigh, like, one, do we wanna get
1050
00:38:27.005 --> 00:38:28.385
- FIDO two keys for everybody?
1051
00:38:28.765 --> 00:38:29.265
- Two,
1052
00:38:29.565 --> 00:38:31.965
- which ones do we get? Because there is
1053
00:38:31.965 --> 00:38:34.204
- the whole, like, support risk trade off thing
1054
00:38:34.204 --> 00:38:35.805
- there that we were talking about with, like,
1055
00:38:35.805 --> 00:38:38.219
- firmware and things like that. So maybe if
1056
00:38:38.219 --> 00:38:40.219
- you got a bunch of YubiKeys years ago,
1057
00:38:40.219 --> 00:38:41.820
- maybe you really don't wanna do those and
1058
00:38:41.820 --> 00:38:44.320
- just wanna push customer or push your users
1059
00:38:44.699 --> 00:38:45.679
- over to,
1060
00:38:46.539 --> 00:38:47.920
- another kind of
1061
00:38:48.219 --> 00:38:48.719
- authentication
1062
00:38:49.260 --> 00:38:51.519
- method that's out there. And I think admins,
1063
00:38:51.675 --> 00:38:53.755
- because you also mentioned admins. I think this
1064
00:38:53.755 --> 00:38:56.155
- is where the admin versus non admin one
1065
00:38:56.155 --> 00:38:58.894
- becomes an interesting thing. Right? Like, my admins,
1066
00:38:59.195 --> 00:39:00.094
- super privileged,
1067
00:39:00.554 --> 00:39:02.315
- I I don't know. I might actually wanna
1068
00:39:02.315 --> 00:39:05.295
- make them, like, UB he only and authenticate
1069
00:39:05.355 --> 00:39:07.360
- a whole bunch. Right? Like so I'm not
1070
00:39:07.360 --> 00:39:09.280
- dependent on a device. I'm not dependent on
1071
00:39:09.280 --> 00:39:11.280
- someone taking a device from them. It's just
1072
00:39:11.280 --> 00:39:13.280
- YubiKey. They've got like, we you can do
1073
00:39:13.360 --> 00:39:15.599
- you can make things like pinbound requirements and
1074
00:39:15.599 --> 00:39:17.940
- all that. So, like, I have some environments
1075
00:39:18.094 --> 00:39:19.934
- that I authenticate to that has, like, a
1076
00:39:19.934 --> 00:39:22.414
- 10 character password, others with an eight, some
1077
00:39:22.414 --> 00:39:24.255
- with a six. Like, it's all over the
1078
00:39:24.255 --> 00:39:25.694
- place, but you can do those kinds of
1079
00:39:25.694 --> 00:39:27.775
- things. And I think admins are a little
1080
00:39:27.775 --> 00:39:30.094
- more willing to take on some of that
1081
00:39:30.094 --> 00:39:32.255
- friction and burden even though we all hate
1082
00:39:32.255 --> 00:39:34.219
- it. I think we're, like, positioned to do
1083
00:39:34.219 --> 00:39:36.699
- it versus just a a regular user who
1084
00:39:36.699 --> 00:39:38.699
- I would wanna have more, like, softer fallback
1085
00:39:38.699 --> 00:39:41.339
- methods for, like, oh, hey. Passwordless, like like,
1086
00:39:41.339 --> 00:39:43.460
- that whole, like, Bluetooth negotiation thing didn't work,
1087
00:39:43.460 --> 00:39:43.779
- but you've got the option of doing a
1088
00:39:43.779 --> 00:39:44.650
- push notification or, OTP
1089
00:39:45.554 --> 00:39:46.054
- option
1090
00:39:46.594 --> 00:39:48.454
- of doing a push notification
1091
00:39:48.755 --> 00:39:50.994
- or, OTP through authenticator or something like that.
1092
00:39:50.994 --> 00:39:52.114
- So at least they're still in the same
1093
00:39:52.114 --> 00:39:54.194
- app, same place kinda thing, and you can
1094
00:39:54.194 --> 00:39:55.795
- move them towards the next. Yeah. And I
1095
00:39:55.795 --> 00:39:57.394
- think as an admin too, I would also
1096
00:39:57.394 --> 00:39:59.730
- say at least two YubiKeys or two FIDO
1097
00:39:59.730 --> 00:40:02.289
- two keys. Like, don't just have one because
1098
00:40:02.289 --> 00:40:04.309
- the last thing you want is
1099
00:40:04.769 --> 00:40:07.250
- your global admin accounts or I mean, even
1100
00:40:07.250 --> 00:40:09.410
- if you have multiple global admin accounts is
1101
00:40:09.410 --> 00:40:11.489
- in an emergency, nobody can find their one
1102
00:40:11.489 --> 00:40:13.410
- YubiKey. They left it in the backpack. It's
1103
00:40:13.410 --> 00:40:14.984
- at their desk and they're on the road.
1104
00:40:14.984 --> 00:40:18.105
- Like, I have a YubiKey that pretty much
1105
00:40:18.105 --> 00:40:20.045
- sits in my general desk
1106
00:40:20.424 --> 00:40:22.844
- vicinity, but then I have another one that's
1107
00:40:23.224 --> 00:40:24.664
- 99.9%
1108
00:40:24.664 --> 00:40:25.484
- of the time
1109
00:40:25.864 --> 00:40:29.389
- with me as I travel around, whether it's
1110
00:40:29.449 --> 00:40:30.969
- a backpack or you have it on your
1111
00:40:30.969 --> 00:40:33.769
- keys, whatever that is. And then I also
1112
00:40:33.849 --> 00:40:36.010
- I actually oftentimes have three where I have
1113
00:40:36.010 --> 00:40:38.429
- another one that's just stuck away somewhere
1114
00:40:38.730 --> 00:40:40.825
- if I need to get to it. But
1115
00:40:40.825 --> 00:40:42.344
- I think you do have to be careful
1116
00:40:42.344 --> 00:40:43.864
- when you start getting into some of the
1117
00:40:43.864 --> 00:40:46.105
- admin and especially global admin. If you're gonna
1118
00:40:46.105 --> 00:40:49.465
- rely on YubiKey only, don't rely on just
1119
00:40:49.465 --> 00:40:51.864
- one YubiKey for that global admin. Have two
1120
00:40:51.864 --> 00:40:53.590
- or three. Even if one of them's in
1121
00:40:53.590 --> 00:40:55.429
- a safe, like, stick it in the safe,
1122
00:40:55.429 --> 00:40:56.949
- stick it away as a backup. You do
1123
00:40:56.949 --> 00:40:58.730
- have to have some break glass someplace
1124
00:40:59.030 --> 00:41:00.789
- to be able to get in and do
1125
00:41:00.789 --> 00:41:03.429
- those things. But I think passwords, I would
1126
00:41:03.429 --> 00:41:06.304
- say, are less and less. I honestly cannot
1127
00:41:06.304 --> 00:41:08.885
- remember the last time I've needed my password
1128
00:41:09.264 --> 00:41:11.184
- for Microsoft 365.
1129
00:41:11.184 --> 00:41:13.264
- Everything I've been able to do lately with
1130
00:41:13.264 --> 00:41:15.284
- a either FIDO two or
1131
00:41:15.664 --> 00:41:16.804
- a number matching
1132
00:41:17.264 --> 00:41:18.085
- push notification
1133
00:41:18.385 --> 00:41:19.764
- password list through
1134
00:41:20.109 --> 00:41:22.210
- authenticator? I've only had to do passwords
1135
00:41:22.829 --> 00:41:24.050
- on Windows devices
1136
00:41:25.070 --> 00:41:25.570
- where,
1137
00:41:26.589 --> 00:41:29.809
- for whatever reason, like Windows Hello for business
1138
00:41:30.269 --> 00:41:32.635
- doesn't work or isn't available for so for
1139
00:41:32.635 --> 00:41:34.635
- example, maybe like a virtual machine. So you
1140
00:41:34.635 --> 00:41:36.315
- go, you spin up a virtual machine, you're
1141
00:41:36.315 --> 00:41:37.994
- testing something out, you bind it to your
1142
00:41:37.994 --> 00:41:38.494
- environment.
1143
00:41:38.795 --> 00:41:41.114
- It might not have, like, a full TPM
1144
00:41:41.114 --> 00:41:43.035
- or, like, a proper TPM to do, like,
1145
00:41:43.035 --> 00:41:44.494
- Windows Hello for business.
1146
00:41:45.355 --> 00:41:47.355
- Especially, like, for you and I, we're typically
1147
00:41:47.355 --> 00:41:49.329
- on Macs. Like, if you spin up a
1148
00:41:49.329 --> 00:41:52.210
- VM in VMware Fusion or over in parallel
1149
00:41:52.210 --> 00:41:53.969
- or something like that, like, you can do
1150
00:41:53.969 --> 00:41:55.510
- Windows Hello on a TPM
1151
00:41:55.969 --> 00:41:56.469
- via
1152
00:41:56.769 --> 00:41:59.809
- a PIN, but your password's also sitting there,
1153
00:41:59.809 --> 00:42:02.369
- like, ready to go and and enabled and
1154
00:42:02.369 --> 00:42:04.025
- spun up. So I I think that's really
1155
00:42:04.025 --> 00:42:06.845
- the only time that I use a password.
1156
00:42:06.905 --> 00:42:08.265
- But you've had to use one? I don't
1157
00:42:08.265 --> 00:42:10.025
- use a FIDO key with macOS because they're
1158
00:42:10.025 --> 00:42:11.945
- so janky there, but you do have, like,
1159
00:42:11.945 --> 00:42:14.505
- touch ID on Macs, certain keyboards, and things
1160
00:42:14.505 --> 00:42:16.349
- like that. So I think that's okay. But
1161
00:42:16.349 --> 00:42:18.349
- on, like, the Windows side of things, like,
1162
00:42:18.349 --> 00:42:19.489
- I'm probably
1163
00:42:20.349 --> 00:42:21.730
- 90 plus percent
1164
00:42:22.269 --> 00:42:23.890
- passkey, just authenticator
1165
00:42:24.190 --> 00:42:25.950
- and, hey. Hope hope it binds to my
1166
00:42:25.950 --> 00:42:27.789
- device the right way. And then, really, I'm
1167
00:42:27.789 --> 00:42:30.369
- only on FIDO keys for the devices that
1168
00:42:30.485 --> 00:42:32.405
- require FIDO keys or for the environments that
1169
00:42:32.405 --> 00:42:35.204
- I log into that require FIDO, but I
1170
00:42:35.204 --> 00:42:36.744
- haven't changed my password
1171
00:42:37.125 --> 00:42:38.644
- in years, I think. I think I still
1172
00:42:38.644 --> 00:42:40.644
- have the same password that I started with
1173
00:42:40.644 --> 00:42:41.465
- when I joined
1174
00:42:41.844 --> 00:42:43.980
- Microsoft six years ago, which is kinda wild.
1175
00:42:43.980 --> 00:42:45.900
- Right? I've worked for those organizations where you
1176
00:42:45.900 --> 00:42:47.980
- change your password every ninety days. I'm like,
1177
00:42:47.980 --> 00:42:49.820
- I either Microsoft's wrong or they were wrong,
1178
00:42:49.820 --> 00:42:52.059
- but I think Microsoft's right in in how
1179
00:42:52.059 --> 00:42:54.619
- they're doing this thing and pushing it through.
1180
00:42:54.619 --> 00:42:56.139
- So I think less and less. Like, there
1181
00:42:56.139 --> 00:42:57.920
- there is, like, less of that reliance.
1182
00:42:58.224 --> 00:42:59.585
- I think if you can get over the
1183
00:42:59.585 --> 00:43:02.545
- technical hurdles and the technological hurdles, which no
1184
00:43:02.545 --> 00:43:04.545
- matter what you say, like, I would die
1185
00:43:04.545 --> 00:43:06.625
- on this hill, like, they are there, and
1186
00:43:06.625 --> 00:43:08.464
- they do exist. Yes. You're gonna have to
1187
00:43:08.464 --> 00:43:11.025
- constantly kinda go with users and work with
1188
00:43:11.025 --> 00:43:13.284
- them to get them through that. But
1189
00:43:13.699 --> 00:43:15.219
- if you're willing to go down that path
1190
00:43:15.219 --> 00:43:16.579
- and do it, I think it is an
1191
00:43:16.579 --> 00:43:17.799
- interesting place
1192
00:43:18.099 --> 00:43:20.259
- to land. So like I said, I would
1193
00:43:20.259 --> 00:43:22.500
- love for Microsoft to provide more guidance, more
1194
00:43:22.500 --> 00:43:24.980
- flexibility, and, like, things like those registration campaigns
1195
00:43:24.980 --> 00:43:26.594
- and flows. And I would actually love
1196
00:43:26.894 --> 00:43:29.135
- to see, like, solid guidance or, like, even,
1197
00:43:29.135 --> 00:43:31.695
- like, a canned implementation of, like, here's, like,
1198
00:43:31.695 --> 00:43:33.934
- a sidecar website or something like that allows
1199
00:43:33.934 --> 00:43:35.715
- you to stand this up in your environment
1200
00:43:35.855 --> 00:43:36.994
- or in the cloud someplace
1201
00:43:37.295 --> 00:43:40.015
- that allows for that new user onboarding. Like,
1202
00:43:40.015 --> 00:43:42.239
- how do I onboard a new user in
1203
00:43:42.239 --> 00:43:44.719
- the passwordless world, and I need to get
1204
00:43:44.719 --> 00:43:47.199
- them, like, set up with a passkey on
1205
00:43:47.199 --> 00:43:49.840
- authenticator? Like, that is still a very weird
1206
00:43:49.840 --> 00:43:52.664
- flow and weird problem to go and solve.
1207
00:43:52.744 --> 00:43:54.505
- I've seen orgs solve that in different ways
1208
00:43:54.505 --> 00:43:55.724
- with, like, custom websites
1209
00:43:56.105 --> 00:43:57.704
- and different things that are out there. But
1210
00:43:57.704 --> 00:43:59.144
- I think Microsoft could do a little bit
1211
00:43:59.144 --> 00:44:01.224
- better kinda, like, shoring up the guidance there
1212
00:44:01.224 --> 00:44:04.105
- and providing, like, here's the hero experience for
1213
00:44:04.105 --> 00:44:05.820
- how those things go. So that way you're
1214
00:44:05.820 --> 00:44:08.140
- not locked into the, well, here's the new
1215
00:44:08.140 --> 00:44:11.340
- customer, client, or organization I'm joining, and every
1216
00:44:11.340 --> 00:44:14.219
- single one has its own bespoke implementation of
1217
00:44:14.219 --> 00:44:16.140
- a 20 page PDF that you've got to
1218
00:44:16.140 --> 00:44:17.980
- go out and read and figure out. 100%.
1219
00:44:17.980 --> 00:44:20.595
- So as always, thanks to folks for listening.
1220
00:44:20.655 --> 00:44:21.155
- Questions,
1221
00:44:21.454 --> 00:44:21.954
- comments,
1222
00:44:22.494 --> 00:44:24.255
- hit us up on the website. We have
1223
00:44:24.255 --> 00:44:26.175
- a contact form there. If you'd be so
1224
00:44:26.175 --> 00:44:27.635
- kind, give us a review
1225
00:44:28.015 --> 00:44:30.929
- in your podcast or or place of choice.
1226
00:44:31.010 --> 00:44:33.269
- Listen to us through Google Play, Spotify,
1227
00:44:33.650 --> 00:44:36.449
- Apple Podcasts, things like that. We'd really appreciate
1228
00:44:36.449 --> 00:44:38.690
- it. I would also call out Ben. We
1229
00:44:38.690 --> 00:44:40.769
- have a subreddit, and we publish all the
1230
00:44:40.769 --> 00:44:43.010
- episodes over to a subreddit. We were hoping
1231
00:44:43.010 --> 00:44:44.949
- to drive maybe some discussions there.
1232
00:44:45.364 --> 00:44:47.065
- So, you know, if folks wanna
1233
00:44:47.364 --> 00:44:49.144
- kinda go over to
1234
00:44:49.525 --> 00:44:51.844
- Reddit what is our subreddit, Ben? Remind me.
1235
00:44:51.844 --> 00:44:52.984
- It's just m s cloud.
1236
00:44:53.284 --> 00:44:56.085
- I have tried to unify everything around m
1237
00:44:56.085 --> 00:44:58.484
- s cloud IT pro, and I believe Reddit
1238
00:44:58.484 --> 00:44:58.984
- is
1239
00:44:59.300 --> 00:45:00.420
- in the same boat. So if you go
1240
00:45:00.420 --> 00:45:03.800
- to reddit.com/rmsclouditpro,
1241
00:45:03.940 --> 00:45:06.980
- you'll see all of the podcast episodes out
1242
00:45:06.980 --> 00:45:08.420
- there as well. So if you wanna have
1243
00:45:08.420 --> 00:45:10.099
- a discussion with us there, maybe the contact
1244
00:45:10.099 --> 00:45:11.699
- form's a little hard to use, things like
1245
00:45:11.699 --> 00:45:14.405
- that, Come and hit us up and leave
1246
00:45:14.405 --> 00:45:16.105
- us a question or a suggestion,
1247
00:45:16.565 --> 00:45:19.285
- anything like that. We always love the feedback
1248
00:45:19.285 --> 00:45:21.605
- and the comments and new ideas that folks
1249
00:45:21.605 --> 00:45:24.804
- bring. Absolutely. Well, thanks, Scott. Go enjoy the
1250
00:45:24.804 --> 00:45:26.244
- rest of your week, and we'll talk to
1251
00:45:26.244 --> 00:45:28.139
- you soon. Thanks, Ben. Have a good one.
1252
00:45:28.139 --> 00:45:28.639
- You
1253
00:45:30.059 --> 00:45:32.619
- too. If you enjoyed the podcast, go leave
1254
00:45:32.619 --> 00:45:34.699
- us a five star rating in iTunes. It
1255
00:45:34.699 --> 00:45:36.380
- helps to get the word out so more
1256
00:45:36.380 --> 00:45:38.699
- IT pros can learn about Office three sixty
1257
00:45:38.699 --> 00:45:39.519
- five and Azure.
1258
00:45:40.059 --> 00:45:41.739
- If you have any questions you want us
1259
00:45:41.739 --> 00:45:43.864
- to address on the show or feedback about
1260
00:45:43.864 --> 00:45:46.264
- the show, feel free to reach out via
1261
00:45:46.264 --> 00:45:48.444
- our website, Twitter, or Facebook.
1262
00:45:48.744 --> 00:45:50.585
- Thanks again for listening, and have a great
1263
00:45:50.585 --> 00:45:51.085
- day.