Hacker News Reader

With a large and sophisticated Corp like Microsoft, wouldn’t they have a Zero Trust kind of security model which means certs and MFA regardless of location, behavior, etc.

Obviously a lot we can only speculate about.

View on HN

I've worked in big companies like Microsoft, so can only comment from that perspective. Due to their size, they often do not have MFA regardless of location. Many didn't even use MFA. Most have been moving there, but it was long, multi-year projects. So I wouldn't be surprised if Microsoft doesn't have MFA for everything.

MSFT employee here: I don't know of an internal service that I use that doesn't have MFA.

I am not going to make a broad statement saying they don't exist, I'm just saying I haven't found one yet. It's really annoying because I rarely have my phone on me when I'm at home so I have to go track it down. I'd be so happy if they let me use a yubikey :(

MFA was standard in industry leaders 10 years ago.

I read it as the possibility that MS source was somewhere it didn’t belong, but who knows?

Reply on news.ycombinator.com