Legacy Haven University

Mission Objectives

Welcome, Candidate! To satisfy the CompTIA Security+ (SY0-701) domain objectives regarding Identity and Access Management (IAM), security professionals must understand how to deploy secure multi-factor authentication (MFA).

Conventional MFA options, such as SMS codes or basic push notifications, are increasingly vulnerable to advanced social engineering tactics like MFA Fatigue (Push Spamming) and technical attacks like Session Hijacking (Inline Phishing).

In this lab, you will transition your enterprise tenant to a phishing-resistant passwordless environment by:

1. Configuring a global tenant policy to support FIDO2 Passkeys as an authorized authentication method in Microsoft Entra ID.
2. Simulating a standard user registration flow to enroll a physical FIDO2 Security Key (YubiKey) via the My Sign-Ins portal.

Part 1: Tenant Administration Settings

In this section, you will log in as a Global Administrator to enable the FIDO2 protocol for your tenant.

Step 1: Launch the Browser

1. Find the Microsoft Edge web browser icon on your secure admin workstation desktop (or use the shortcut icon on the taskbar).
2. Double-click the icon to open the web browser. The homepage is pre-configured to point to the Microsoft Entra Admin Center.

Step 2: Log into the Microsoft Entra Admin Center

1. On the Microsoft Entra sign-in screen, notice that your administrative username (admin@securelabs.onmicrosoft.com) and secure password are preloaded.
2. Click the blue Sign in button to authenticate and access the cloud management dashboard.

Step 3: Expand the Protection and Security Settings

1. Look at the left-hand navigation sidebar. Under the Protection section, locate and click on Security.
2. Expanding this submenu reveals additional enterprise security configurations such as Conditional Access, Identity Protection, and Authentication Policies.

Step 4: Access Authentication Methods

1. In the newly expanded Security submenu on the left, click on Authentication methods.
2. This loads the policies interface, which serves as the central directory dictating what types of credentials your users are authorized to register and use.

Step 5: Select the Passkey (FIDO2) Policy

1. In the main console window, review the Policies table. Note that standard MFA methods (like Microsoft Authenticator) are currently enabled, but Passkey (FIDO2) is disabled.
2. Click directly on the Passkey (FIDO2) row to open its granular properties and tenant configuration settings.

Step 6: Enable FIDO2 Policies and Define Scope

1. Locate the toggle switch labeled Enable this Authentication Policy and click it to change the state to Yes (Enabled).
2. Under the Target Audience configuration, click the dropdown menu and select All users to make this authentication policy universally available in your directory.

Step 7: Save Your Administrative Changes

1. Scroll to the bottom of the policy configuration page.
2. Click the blue Save Configuration button to commit your edits to the Microsoft Entra ID database.
3. Verify that the policy table updates to show Passkey (FIDO2) as Enabled for All users.

Part 2: End-User Onboarding Simulation

Now that FIDO2 is authorized at the tenant level, standard enterprise users must bind their physical hardware security tokens to their individual accounts.

Step 8: Open a New Browser Context

1. To simulate a standard employee onboarding experience, click the + (New Tab) button on the Microsoft Edge tab bar.

Step 9: Navigate to the User Sign-Ins Portal

1. Select the My Sign-Ins tab from your browser’s tab bar. This represents navigating to the endpoint where users manage their personal security verification preferences (https://mysignins.microsoft.com).

Step 10: Authenticate as the User

1. The portal is pre-configured to sign in as Sarah Connor (sconnor@securelabs.com).
2. Click the blue Next button to bypass standard credentials and proceed to Sarah’s user profile control panel.

Step 11: Navigate to Security Info

1. In the left navigation menu of the My Sign-Ins dashboard, click on Security info. This page displays active MFA options registered to the user account.

Step 12: Initiate New Verification Method

1. Review Sarah’s current baseline MFA methods (which currently consist of a standard password and the Microsoft Authenticator mobile app).
2. To add the phishing-resistant option, click the + Add sign-in method button.

Step 13: Choose FIDO2 Passkey Option

1. In the popup modal, click the dropdown menu and select Passkey (FIDO2 Security Key).
2. Click the blue Add button.

Step 14: Complete the Cryptographic Hello Handshake

1. The browser will invoke your operating system’s local credential broker via a Windows Security dialog box.
2. Insert your physical key into an available USB port.
3. Click Touch Security Key (Simulate) to mimic the physical gesture required to release the private key from the hardware token’s secure enclave.

Step 15: Name the Registered Token

1. To keep track of corporate physical assets, provide a recognizable and descriptive identifier for the security key.
2. Set the name to YubiKey 5C NFC - Secure Token.
3. Click Finish to write the public key registration to Entra ID.

Part 3: Verification & Security Concept Mapping

Step 16: Verify Success

Confirm that Passkey (FIDO2 Security Key) is successfully listed in Sarah’s active verification methods with a status denoting it as a Phishing Resistant method.

SY0-701 Alignment Highlights