I ❤️ My Password

The talk opens by describing identity as a pairing of a visible username and a hidden secret, and traces how people have protected access for thousands of years, from ancient locks to early computer passwords. The speaker then looks at how Active Directory's default password policies and later, conflicting guidance on complexity and expiration left users confused and frustrated. Predictable password habits are used as an example of why rotation rules alone do little.

The middle of the talk turns to the present. Figures from Microsoft's digital defense report show multi-factor authentication adoption still lagging, with administrators not much ahead of ordinary users. The speaker explains how Azure AD grew to many authentication methods, which made choices hard for administrators, and how some organisations fell back on weaker federation setups. Legacy systems and the assumption that every worker carries a phone create further barriers, especially for frontline staff.

The practical part covers recent changes: authenticator features built into mobile apps, number matching to resist push fatigue, system-preferred MFA, custom authentication strengths, and conditional access policies that limit access by device, location and method. The speaker suggests reviewing exported policies with a community tool and stresses communication, education and user participation over forced change. The takeaway is that identity controls have to account for the people who use them, and that the tooling is still maturing.