Microsoft is finally adding multi-factor authentication to most of the business versions of Office 365 and, in the near future, to the Office desktop applications as well. But unless I'm reading this wrong, it doesn't appear that they will be adding this much-needed feature to Office 365 Small Business and Small Business Premium, at least not yet.
In a post to the firm's Office Blog today, Microsoft's Paul Andrew explained that the firm is adding multi-factor authentication to Office 365 Midsize Business, Enterprise plans, Academic plans, Nonprofit plans, and standalone Office 365 plans, including Exchange Online and SharePoint Online.
"This will allow organizations with these subscriptions to enable multi-factor authentication for their Office 365 users without requiring any additional purchase or subscription," Andrew writes. "Multi-factor authentication has been available for Office 365 administrative roles since June 2013, and today we're extending this capability to any Office 365 user."
With multi-factor authentication, users will need to enter a password and then a code from a phone call, text message, or smart phone-based app notification in order to sign-in. This functionality is sometimes called two-step authentication, as is the case with the Microsoft account that powers Outlook.com, SkyDrive (soon to be renamed OneDrive), and other consumer services.
Intriguingly, support for multi-factor authentication will also be added to Microsoft's desktop-based Office applications. Today, Office 365 users that are configured for multi-factor authentication must use app passwords to sign-in to the desktop Office applications. But an Office 2013 update coming later in 2014 will add native multi-factor authentication support to those applications.
"We're planning to add native multi-factor authentication for applications such as Outlook, Lync, Word, Excel, PowerPoint, PowerShell, and OneDrive for Business, with a release date planned for later in 2014," Andrew notes. "This update includes the current phone-based multi-factor authentication, and it adds capability to integrate other forms of authentication such as third-party multi-factor authentication solutions and smart cards. We'll give you more information about these and more updates closer to release."
I've been waiting for two-step authentication to come to Office 365 Small Business and Small Business Premium, and find it a bit odd that Microsoft account and Outlook.com have had this important security feature since last year. I've asked Microsoft about this and will report back if there's any comment.
