Configuring push notification for Active Directory-based actions

Configuring push notification for Active Directory-based actions

Push notification is a method of authentication which involves users receiving an alert on their mobile devices. When push notification is configured as a multi-factor authentication (MFA) method, users need to have a push notification app installed on their mobile devices. During authentication, they provide their account credentials following which they receive a push notification via the app. When they accept the notification, they are authenticated. Push notification is one of the more secure methods of authentication since it does not involve entering passcodes. Also, with push notification, users have the option of denying the push notification if they have not initiated the authentication process and can take action against the attempted breach. Push notifications are also quick as they only involve a tap of a finger.

Active Directory-based user actions like domain logins, password changes, self-service password resets and self-service account unlocks are sensitive activities that require more than the default username and password (or just username in case of password resets!). MFA ensures that users verify their identity at multiple levels, using methods like push notifications that do not involve credentials. This helps prevent attacks like phishing and brute force.

If admins do not prefer employing push notification alone and need to include additional methods of authentication like SAML authentication, and fingerprint authentication, then ADSelfService Plus is the right solution. ADSelfService Plus, an Active Directory self-service password management and single sign-on solution, in a one-stop product that includes self-service password resets and account unlocks that can be secured by any of the 15 supported MFA methods. Some of them are push notification, Google Authenticator, YubiKey Authenticator, and RSA SecurID.

Besides Active Directory self-service actions, ADSelfService Plus also employs MFA during:

  1. Windows, macOS, and Linux logins.
  2. Enterprise application logins through single sign-on (SSO).
  3. Self-update of Active Directory profile information, subscription to mail groups, and employee search using ADSelfService Plus.

Push notification for MFA in ADSelfService Plus can be enabled with minimal steps

  1. Navigate to Configuration > Self-Service > Multi-factor Authentication > Authenticators Setup.
  2. From the Choose the Policy drop-down, select a policy.
    Note: ADSelfService Plus allows you to create OU and group-based policies. To create a policy, go to Configuration → Self-Service → Policy Configuration → Add New Policy. Click Select OUs/Groups, and make the selection based on your requirements. You need to select at least one self-service feature. Finally, click Save Policy. Only users belonging to OUs and groups included in the policy can perform the self-service feature(s) selected.
  3. Click the Push Notification Authentication section.
  4. Select Enable Push Notification Authentication.

Notes
Note: Users need to download the ADSelfService Plus iOS or Android mobile app to use this authentication technique.
This is a device-based enrollment. If users install the app on another device, they need to enroll again.
If a user performs a self-service password reset or account unlock from a mobile site, users cannot use Push Notification Authentication to prove their identity.

Enable push notification for Active Directory password resets

  1. Go to Configuration → Self-Service → Multi-factor Authentication → MFA for Reset/Unlock. In the MFA for Reset/Unlock section, enter the number of authentication factors to be enforced, and select Push Notification Authentication along with the other authentication techniques to be used.
  2. Click Save Settings.

Enable push notification for Active Directory domain logins

  1. Go to Configuration > Self-Service > Multi-factor Authentication > MFA for Endpoints.
  2. Select a policy from the Choose the Policy drop-down. This will determine which authentication methods are enabled for which sets of users.
  3. In the MFA for Machine Login section, check the box to enable MFA for Machine Login and select the number of authentication factors to be prompted. Select the Push Notification Authentication and other required authenticators from the drop-down.
  4. Click Save Settings.




      New to M365 Manager Plus?
      New to M365 Manager Plus?
        New to RecoveryManager Plus?
        New to RecoveryManager Plus?
          New to Exchange Reporter Plus?
          New to Exchange Reporter Plus?
            New to SharePoint Manager Plus?
            New to SharePoint Manager Plus?
                See all integrations
                New to ADManager Plus?
                See all integrations
                New to ADManager Plus?

                  New to ADSelfService Plus?

                  Start your free trial
                  Start your free trial

                      Related Products