The question or issue around MFA is two folded:
- [SAAS] Partners / CSP’s are required to use MFA on all accounts they do add to their customer tenants
a. They do have a choice to do this via third party as long as they do it on all the accounts they do own which they did add to their customer tenants
b. They do have a choice to do this via Azure portal via a policy or via Office 365 / Azure portal on a per user base as long as they do it on all the accounts they do own which they did add to their customer tenants
- [OnPrem] Customers are free to decide though it is highly recommended to use MFA on all accounts that access their ERP data
a. They do have a choice to do this via third party
b. They do have a choice to do this via Azure
In both scenario’s, the accounts being used for CRM / SharePoint / SMTP in Dynamics NAV / Dynamics 365 Business Central do not support MFA. For this scenario, App Passwords must be used. There are two ways of generating App Passwords:
- On a per user base via Office 365 portal / via Azure portal on a per user base
- Via an Azure Conditional Access Policy
a. Free Security Defaults policy => all users will get the MFA assigned, no exceptions, no compatible App passwords are being generated, no Azure premium licenses needs to be purchased
b. Conditional Access Policies in Azure => all users can get the MFA assigned, exceptions can be made to allow MFA to be assigned on a per user base, no compatible App passwords are being generated, Azure premium licenses needs to be purchased to allow this flexibility
The issue with not using a conditional access policy is that you can easily forget to enable MFA on newly created account. This is where the Azure premium licenses do come into play. In addition, creating a runbook for users how to create a user in Office 365 and Dynamics NAV / Dynamics 365 Business Central can easily be adjusted with the MFA requirement.
When doing this on a per user base (if your starting point is editing a user via Office 365 you will end up here):
Or editing an user via Azure Portal, Azure Active Directory users, you will end up here :
NOTE: when clicking on "here" replace <<tenant ID>> in the url above with your tenant ID which will happen automatically if you do log on to your partner portal. The scenario is by design. It is a security requirement for CSP's or a security enhancement that can be enabled by customers.
Clearly hope this does help.
