Tenant setup 05 — Securing user accounts

📘 Complete tenant-setup cookbook in one PDF This article is part of the series. Full series + screenshots in one document: download PDF . (PDF is currently in Czech.

In today's part of the cookbook we look at securing users — or rather their accounts. You can't stand behind every user all day, so it's good to protect them somehow, mostly from themselves.

First, Authentication methods. Open Authentication methods → Policies and enable all the strong methods: Passkey (FIDO2), Microsoft Authenticator, SMS, Temporary Access Pass, Hardware/Software OATH tokens. Skip Email OTP unless you have a use case. Don't forget to register every existing FIDO2 key under FIDO2 settings.

Password Protection lets you ban up to 1,000 passwords. Case-insensitive, with substitutions blocked (0 for o, 5 for s). Use ChatGPT to generate the list ("generate 1,000 simple passwords my employees in <company> might pick, localized for Czech, ignore case and substitutions"). Heads-up: "Enable password protection on Windows Server Active Directory" can collide with your AD Group Policy — usually fine, but Windows occasionally surprises.

Finally, Authentication strengths. Create one custom strength using Temporary Access Pass (one-time use). We'll wire it into Conditional Access in the next post for device-join flows. Multi-use TAP works too if that fits your operation better.