Skip to main content
日本語 简体中文 繁體中文

Special Article: Configuration and Migrate Guide for Enhanced Security

Overview

In conjunction with individual email announcements from us (MFA deployment for all users, WS-Trust discontinuation, and migration to the new login screen), we have prepared a dedicated page compiling official help articles and FAQs to help customers and partners using Access Control proceed smoothly with the necessary actions and configurations.
Please refer to the following collection of links and explanations depending on your purpose and the procedure.

Table of Contents

  1. 【Highest Priority】Checking WS-Trust (legacy authentication) logs and discontinuing operation：
    This procedure checks the usage status of legacy authentication in your environment and configures legacy authentication to Deny if it is not in use.
  2. 【Highest Priority】Deploying MFA (multi-factor authentication) to all users：
    This procedure configures multi-factor authentication, such as OTP and certificates, for all users to enhance security.
  3. 【Sequentially】Migration to the new Access Control login screen：
    This procedure switches to the new Access Control login screen, which complies with the latest security guidelines.

Procedure

1.Checking WS-Trust (legacy authentication) logs and discontinuing operation

To disable (discontinue) the WS-Trust authentication policy, first check the usage status in the logs, then update the Access policy group configuration to discontinue its use.

  1. Check operation logs
    Use the following procedure to check and identify from the logs whether there are any users or legacy systems within your organization that are still using legacy authentication.
    How to check the basic authentication access log
  2. Stop allowing WS-Trust authentication (review policy)
    Use the following procedure to check the configuration of the Access policy group in operation and change ［Condition to allow legacy authentication］ to "Deny."
    [Access Control] Create / Edit Access Policy Group

2.Deploying MFA (multi-factor authentication) to all users

This procedure covers policy and user configuration for deploying MFA (OTP, Device Certificates, etc.) throughout the organization.

Setting up one-time passwords (OTP) for all employees

*Before configuration, please read the frequently asked questions.
[Access Control] Frequently Asked Questions Regarding Requiring Admin OTP Entry

  1. Notification of OTP configuration
    Notify all Users within the organization to Set up OTP using one of the following procedures.
    *Action is required by each User.

    You can check the OTP configuration status by filtering the Users list in Access Control by ［OTP］－［Not set］ or ［Unknown］.
    Reference：[Access Control] Searching for Users

  2. After User OTP configuration is complete, use the following procedure to check the configuration of the Access policy group in operation and change ［Skip OTP authentication］ to "Always require."
    *After changing this configuration, OTP will be required every time you log in to Access Control.
    We recommend notifying Users in advance.
    [Access Control] Create / Edit Access Policy Group

Configuring access control using certificates

In addition to OTP (One-Time Password), you can use Device Certificates if you want to strictly allow access only from company devices or authorized Devices.
Please refer to the following article for detailed setup procedures.
[Device Certificate] List of Setup Procedures

3.Migration to the new Access Control login screen

By migrating to the new login screen available from April 2026, you can use a login flow that complies with the latest security guidelines.
Overview：Release Information: [Access Control] Support for New Log in Screen in the 5th week of March 2026

Please refer to the following article for the migration procedure.
[Access Control] Migration Procedure to the New Login Screen

FAQ

Is authentication using only an ID/password insufficient as a security measure?

If login passwords are reused or simple passwords are configured, there is a high risk that attackers may compromise authentication by exploiting Email Address and Password information leaked from other companies' services onto the dark web or by launching brute-force password attacks. It is necessary to reduce risk by using an authentication method that adds factors other than an ID/password.

Is control based solely on the source global IP address insufficient as a security measure?

Although this provides a higher security level than authentication using only an ID/password, there remains a risk of spoofing. If an attacker infiltrates the internal network, relying solely on the global IP address means the attacker will be treated no differently from a legitimate User. It is also not defined as multi-factor authentication in the latest international guidelines, such as those from NIST. Given the recent increase in cyberattacks and the advancement of attack techniques, it is becoming increasingly important to adopt authentication methods that are difficult to spoof and resistant to phishing.

Is control using only OTP insufficient as a security measure?

Adding OTP (One-Time Password) to authentication using only an ID/password can enhance the security level. However, phishing techniques such as the increasingly common AiTM attacks (adversary-in-the-middle attacks) enable attackers to intercept the authentication flow, and methods for stealing authentication cookies even when OTP is used are increasing. Using authentication methods that use private keys stored on the Device, such as phishing-resistant passkeys and Device Certificates, is an effective countermeasure against such attacks.

What can be done if there are Users who will not Register OTP?

If you have an email client that is already in operation, maintains authentication, and can always be checked, an administrator can configure any Email Address as the OTP delivery destination and enable OTP.

Follow the steps below to enter an Email Address in the ［OTP Notification Email］ field for the target user and update the user to set up OTP via Email Address.
[Access Control] How to Perform User Batch Update
After completing the configuration, follow step 2 of the One-Time Password (OTP) Configuration for All Employees procedure to enable OTP requests.

※If a user cannot view emails sent to the OTP delivery destination and is unable to log in to Access Control, please use an emergency OTP to log in and Set up OTP using another Email Address or an application.
[Access Control] OTP Issuance Methods and Expiration Period
[Access Control] Configuration for Receiving OTP (One-Time Password) via Connected Application
[Access Control] Configuration for Receiving OTP (One-Time Password) via Email

Is MFA (OTP) configuration required when using Device Certificates?

When access restrictions using Device Certificates are applied, highly secure device authentication with phishing resistance is already performed.

However, you can also implement stronger multi-factor authentication by combining 「Device Certificates」＋「OTP」, for example, to prevent impersonation when a device is stolen or lost. Please consider this option based on your organization's security policy and the balance with usability.

I want to skip multi-factor authentication in Microsoft 365 after completing multi-factor authentication in Access Control

If multi-factor authentication is configured in Access Control, you can skip multi-factor authentication on the Microsoft 365 side by following the procedure below.
Release Information: [Access Control] Added a feature to skip Microsoft 365 multi-factor authentication when specific authentication is performed in Access Control in the 3rd week of February 2026

※Reconnecting the federation integration may be required. For details, please refer to the article above.

Will I be unable to use Access Control if I do not configure MFA?

At this time, we do not plan to implement any measures that would prevent the use of Access Control because MFA has not been configured for a User account.

However, in response to the increasing sophistication of cyberattacks in recent years, we strongly recommend requiring MFA for All User accounts to ensure the secure use of our services.

As described in the following article, OTP will be required for Admin accounts from December 1, 2026. Please take the necessary action.
[Access Control] Notification of Mandatory OTP (One-Time Password) for Administrator Accounts

※The content and FAQ in this article will continue to be added and updated as needed based on inquiries received from customers. Please check this article as necessary.

Translation Disclaimer

This article has been automatically translated from the original Japanese version for your convenience.
While we strive to ensure accuracy, we cannot guarantee its reliability or completeness.

In the event of any discrepancies or questions regarding the content, the official Japanese version shall prevail.