Trigger MFA so helpdesk can authenticate a user

Avatar
Benjamin Gaudette

This request may fall outside of Nerdio’s current scope, but I believe it could be a strong differentiator against the competition. Many MSP clients of Nerdio rely entirely on Microsoft, and the one feature we are missing—something Duo already provides—is the ability to trigger MFA on demand for a user.

Example: User calls helpdesk for support. Helpdesk want to authenticate the user, Helpdesk trigger MFA, user receive a number matching on his MS Authenticator (could be other methods), User share the number to Helpdesk, Identity is validated.

Examples :

https://www.entraneer.com/blog/entra/authentication/transactional-mfa-entra-id

https://www.cyberdrain.com/automating-with-powershell-sending-mfa-push-messages-to-users/

7

Comments (4 comments)

Sort by
3
Avatar
Travis Lamming

I really like this idea, and agree with DUO its nice how you can trigger a  pop up when on with a client. I'm suprised that microsoft hasnt enabled something like this; I really hope they wouldnt hide it behind a higher end license, too. 

0
Avatar
Carl Long
Thank you for submitting your feature request—we truly value input from our community.

Next steps:
     • We will review your request and update its status as it progresses through our evaluation process.
     • If any clarification is needed, we'll follow up with you directly in the comments.

We also encourage the community to influence our decision through comments, votes, and feedback.
0
Avatar
Dave Stephenson

This seems like a cool idea.
I'm wondering if we can add it as part of the Risky Users request?
Maybe something with the “Revoke multifactor authentication sessions” or "Revoke sessions" functions? 🤔

I looked over those links you sent and looks like it's possible to use the same app registration that Nerdio Manager is utilizing. However, one of the things it mentioned was “MFA Fatigue” being an issue.
If you're using this to verify the user's identity every time a user submits a request (or at a certain level/type of a request), do you think they'll get tired of the prompts?

My other “devil's advocate” question is:
If someone doesn't use Microsoft Authenticator (i.e. Windows Hello, FIDO2, Certificates, etc.) do we need to handle it differently or do we just let Microsoft handle that and as long as it's validated, it sends a “User Approved MFA Request” back to NMM?

 

 

1
Avatar
Benjamin Gaudette

I don't see MFA fatigue being an issue. Some users contact helpdesk once a year. 99% of our users use MS authenticator. 

Please sign in to leave a comment.