TomF.32212 (Customer) asked a question.
Hi everyone,
Since using Okta to protect O365 we have been detecting a lot of brute force password attacks. It appears that bots, from all over the world, are trying to log into O365 by guessing the users password. This is leading to the user and the Okta admin receiving lots of emails from Okta saying their account has been locked out due to too many failed login attempts.
While it is great that Okta is detecting and protecting against this, it is also becoming annoying for the user who is constantly getting their Okta account locked out and email alerts. We have set the Okta lockout threshold to 1 attempt lower that AD so the AD account never gets locked out.
When it started, I used Okta's 'Blocked Countries' feature to blacklist the countries it was coming from. Unfortunately the attacks appear to come from pretty much every country in the world now and this approach doesn't seem practical.
Does anyone have a better way to deal with this? We have MFA enforced and we use behavioral analytics, so the attacker will (hopefully) never gain access to the users mailbox. It doesn't stop them form attempting to guess the password and causing account lockout though.
Any advise would be appreciated.
Thanks,
Tom
Hi Sammy, Ryan, and Tom,
Hope everything is going well.
Okta recently released a product feature – pre-authentication sign on policy evaluations – that helps applies the Sign-On policy before authentication.
You can enable the feature on the feature manager (On the admin console, click Settings > Features, and switch on "pre-authentication sign on policy evaluations").
Image: https://imgur.com/a/8QxVHes
With the feature is enabled, all the existing Sign-On policies are evaluated by Okta before the password validation. After that, you can write sign-on policies to deny access.
Another thing you can do is granularly deny suspicious access for specific users/groups, reducing the number of blacklisting rules you end up writing. Examples of Policies/Rules you can create:
> Users from Brazil cannot login outside of South America.
> Users from the Operations team cannot login outside the office.
Image: https://imgur.com/a/FkE871c
The "pre-authentication sign on policy evaluations" mitigates lockouts on modern authentication to Okta (when the O365 login shows the Okta UI).
For mitigating lockouts legacy O365 authentication (basic authentication over SMTP, POP, IMAP, and ActiveSync), you can create an Authentication Policy on O365, like Ryan suggested.
Here's what I got from MSFT official O365 doc: https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/disable-basic-authentication-in-exchange-online
To setup a new policy, you can use the following command (it automatically sets the policy without basic auth):
New-AuthenticationPolicy -Name "Block Basic Authentication"
Image: https://imgur.com/a/79NRgAT
Then, you can use PowerShell to add one user to test the policy:
Set-User -Identity <UserId> -AuthenticationPolicy "Block Basic Authentication"
Set-User -Identity <UserId> -STSRefreshTokensValidFrom $([System.DateTime]::UtcNow)
If you like the results, you can to add more people to the policy (still on Powershell. This is another example from Microsoft:
$Engineers = Get-User -ResultSize unlimited -Filter {(RecipientType -eq 'UserMailbox') -and (Title -like '*Engineering*')}
$EngId = $Engineers.MicrosoftOnlineServicesID
$EngId | foreach {Set-User -Identity $_ -AuthenticationPolicy "Block Basic Authentication"}
$EngId | foreach {Set-User -Identity $_ -STSRefreshTokensValidFrom $([System.DateTime]::UtcNow)}
Finally, you can set the new policy as the default for all the new users:
Set-OrganizationConfig -DefaultAuthenticationPolicy "Block Basic Authentication"
With that, all new users will end up in the new policy.
Hope this helps. Ty,
Frederico