Next changes in Microsoft Certifications

Microsoft is planning a massive change in some of their certifications, so the aim of this post is to explain and extract some of that information.

• Changes for Microsoft 365 Certified: Modern Desktop Administrator Associate (MD-100+MD-101)
  • The following exams (MD-100 & MD-101) are going to be retired next July, this certification would be consolidated into a single exam (MD-102)
  • We have until July 2023 to obtain both exams and obtain the competency (if we only obtain one exam, is useless)
  • From May 2023 a beta exam of MD-102 will be launched
  • If we already have the MD-100 & MD-101 certifications, the only thing that we need to do is to be aware of our renovations dates and have active the certifications.

• Changes for Microsoft 365 Certified: Enterprise Administrator Expert (MS-100+MS-101)
  • The following exams (MS-100 & MS-101) are going to be retired next July, this certification would be consolidated into a single exam (MD-102)
  • We have until July 2023 to obtain both exams and obtain the competency (if we only obtain one exam, is useless)
  • From May 2023 a beta exam of MS-102 will be launched
  • If we already have the MS-100 & MS-101 certifications, the only thing that we need to do is to be aware of our renovations dates and have active the certifications.

• Changes for Microsoft 365 Certified: Teams Voice Engineer Expert (MS-720)
  • In June this certification will be deprecated
  • From March a new beta exam will be available (MS-721)
  • If we do not have the certification and we’re evaluating to obtain it, I Will recommend waiting until the new (or beta) certification will be launched, meanwhile, prepare the certification

• Changes for Microsoft 365 Certified: Teams Application Developer Associate (MS-600)
  • The certification Will be retired next December.
  • By today, there aren’t more news about what Will be next.

• Changes for Microsoft 365 Certified: Security Administrator Associate (MS-500)
  • The certification Will be deprecated in June.
  • The content this certification Will be divided into SC-200, SC-300 y SC-400

If you need more info about it, check out the official post: https://techcommunity.microsoft.com/t5/microsoft-learn-blog/evolving-microsoft-365-certifications-help-keep-you-in-sync-with/ba-p/3719265

Advertisement

PassWordless Authentication with Fido 2 Keys – Part 2

This is a second part of my blog about reviewing Fido2 Keys from Feitian (PassWordless Authentication with Fido 2 Keys – Albandrod’s Memory (albandrodsmemory.com))

In this case, I am testing out the K33 and K44 products

The initial setup of the tenant is covered in my previous post, so I will skip the details of how to do it.

To configure the K33 key you will need to download the app “BioPass FIDO2 Manager” from the Windows Store:

And connect your K33 key via USB to the laptop (otherwise won’t be possible to configure), the configure your preferred PIN, and finally configure your fingerprints. The process to the K44 is similar, but in this case, I am using and Ipad, and the app to download is “iePassManager”

Once the two keys are configured, you’re ready to setup them in AzureAD MFA (https://aka.ms/setupmfa)

K33 process

I have explained the process of how to initially configure the K33 key, but I strongly recommend to follow the steps mentioned in K33_Microsoft_Services_Guide.pdf (ftsafe.com) to pair the key with your laptop.

Once the key has been paired, the process to configure it is simple, the only thing that you must take into account is that even it is Bluetooth Key, you must configure it as an USB key (but remember, it must be paired first with the device).

Authentication with K33

K44 Registration Process

Once again, it is needed to set up the PIN for the Key, in my case, it has been done with the Ipad, but the registration process, is easy as the video shows:

The sign in process is very similar as we’ve seen before, so I do not want to cover this, but as you can observe, the registration and use of Fido2 Keys is pretty simple.

Inclusion, MFA keys and particularly, Fido2 Keys from Feitian are great!! But now, something that you must consider when implementing Fido2 keys in your environment:

There’s no way to enforce PIN policy in Azure AD: Every user can set up their own PIN to use their key. There is no centralized way to manage PINs, but Windows Hello for Business blocks simple PIN codes by default.  The bad news is, if you add the key directly to your Azure AD account, these settings are overridden ☹

Feitian offers multiple options for connecting your key, so you’re sure to find one that works for you. Among the available connections are USB-A, USB-C, NFC, Bluetooth, PIN, biometrics, and more.

Biometrics requires app installation: you need to download the manufacturers’ application that enables fingerprint scanning, which is additional software that you must consider to install

Again, I want to thanks Feitian for providing the security keys to test out the use cases

Till next time!

My two cents for 2022

Nobody can doubt that 2021 has been the year to adopt the cloud (due to COVID of course), mostly because most of us needed to work from home. We can say that business has changed and “Probably” will never go back to was it was.

Remote work will continue growing, so in 2022 we will need to protect our assets much better, and for this, here are my predictions/concerns for the next year:

• Hacker will continue to try to breach in our systems and try to access by the weak link in supply chains. For this, we need to reduce privileges for internal and external accounts, and not forget about machine identities

• Every business needs to reduce his own Attack Surface, to reduce the blast radius of any exposure or incident. To achieve this, tools that provide visibility into identities and activities are essential, we need to be sure of what happened and respond quickly to those incidents

• Protect the data is your responsibility, try to plan and build security controls for your cloud migration roadmap

• Zero Trust will continue growing, but remember to keep in touch with all the components: network, identity, permissions, configurations… The need of tools that give visibility is essential here.

• Currently we put the focus on protecting our user identity with MFA controls, but what about machine identities? These identities and permissions are being exploited in every breach to make lateral attacks, so we will need to be aware of that during the next year.

For now, I think that it’s all, stay tuned to the blog and happy new year!