Receiving guidance from a contractor that restricting unknown devices (regardless of MFA, location, etc.) to an Azure tenant does not improve security in any meaningful way, and just creates a headache for the administrator who needs to run around allowing exceptions for external devices every time someone loses or forgets a corporate-owned device.

I am trying to understand if allowing users to install the MS365 authenticator app on an untrusted (employee-owned, personal) device is fine (am I also wrong here?), but allowing them to log in and access ms365 from that device is dangerous because it pushes both factors of authentication (user-known password, installed authenticator app/otp) to a completely unmanaged device.

My thinking is that data exfiltration is a breeze here since an attacker just has to pop one of these insecure user devices, monitor and collect authentication material, and begin pumping out the information from that device. I was assured that this type of thing is "handled by Azure's built-in DLP and RBAC which does geolocation, UEBA, etc." and that restricting access to certain devices (eg. a corporate laptop or cellphone) "defeats the purpose of MS365's high accessibility" and is "the old AD way of thinking".

So my question is: as the person in charge of securing this tenant, should I argue that we restrict access to sensitive information (accounting, hr, etc.) only from highly managed (Azure AD joined TPM2.0, STIG hardened, antivirus-agent-running, etc.) endpoints such as I have been taught forever, or am I misguided, and there actually a 0-trust methodology that I'm not seeing or aware of?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.