So there is a huge partner opportunity to solve this problem as well.īlog post 1 - Introducing the effectiveness of EvilGinx against Office E3 'Always On MFA'īlog post 2 - highlights several ways EMS can block EvilGinx.

And also 100 million that may need help transitioning from user authentication to also include machine authentication (if they haven't already). That means there is a gap of 80 million that need help transitioning to EMS. We learned in Microsoft's latest quarterly earnings that there are 180 million total Office 365 subscribers, but only 100 million EMS subscribers. We strongly recommend clients upgrade to AAD P1 or EMS E3 to provide the best protection against MFA bypass. This is a two-part blog series where we publish our test results. U2F is also effective (check out the blog for all the tests we ran). So we want to raise awareness: If you are doing only user-authentication today, it's important to plan to include additional factors such as machine authentication like Hybrid Domain Join or Intune UEM compliance checking, or certificate-based-authentication using the EMS E5 feature: Microsoft Cloud App Security Conditional Access App Control (say that three times really fast!). Last weekend I tested 13 Microsoft solutions and found 6 that are effective at blocking EvilGinx2 using mostly Machine Authentication. It is effective against both SMS/Text and MSFT Authenticator App (aka User Authentication). EvilGinx2 is a simple tool that runs on a server and allows attackers to bypass the 'Always ON' MFA that comes built into Office E1/E3 plans. This is a educational post on how Azure Conditional Access can defend against man-in-the-middle software designed to steal authentication tokens.

Azure u2f