Corrected MFA

Author: v-meluri

learn-pr/wwl-azure/implement-identity-based-security-azure-machine-learning/includes/3-implement-conditional-access-policies-azure.md

@@ -2,21 +2,21 @@ Security groups control who can access your Azure Machine Learning workspace, bu
 
 ## Evaluate sign-in context with Conditional Access
 
-Conditional Access acts as a policy enforcement checkpoint between users and your Azure ML workspace. When a data scientist attempts to sign in, the policy engine evaluates multiple signals simultaneously. It checks whether the user is connecting from a trusted network or an unfamiliar location. It verifies whether their device meets your organization's security standards—is antivirus software up to date, is the disk encrypted, are operating system patches current? It examines authentication strength—did the user provide just a password, or did they complete multi-factor authentication? Based on these signals, the policy grants access, requires additional verification, or blocks the connection entirely.
+Conditional Access acts as a policy enforcement checkpoint between users and your Azure ML workspace. When a data scientist attempts to sign in, the policy engine evaluates multiple signals simultaneously. It checks whether the user is connecting from a trusted network or an unfamiliar location. It verifies whether their device meets your organization's security standards—is antivirus software up to date, is the disk encrypted, are operating system patches current? It examines authentication strength—did the user provide just a password, or did they complete multifactor authentication? Based on these signals, the policy grants access, requires additional verification, or blocks the connection entirely.
 
 :::image type="content" source="../media/conditional-access-policy-enforcement-checkpoint.png" alt-text="Diagram showing how Conditional Access acts as a policy enforcement checkpoint between users and an Azure ML workspace.":::
 
 Unlike static security groups, Conditional Access adapts to changing conditions. A data scientist signing in from your corporate office on a managed laptop requires minimal verification. The same user connecting from a coffee shop on a personal device triggers stricter controls. This dynamic approach maintains security without creating friction for legitimate users in low-risk scenarios. At the same time, it raises barriers when risk indicators suggest potential compromise—for example, simultaneous sign-in attempts from geographically distant locations within minutes.
 
-## Enforce multi-factor authentication for workspace access
+## Enforce Multifactor authentication for workspace access
 
-Password-based authentication provides weak protection for AI infrastructure containing sensitive training data and proprietary models. Multi-factor authentication (MFA) adds a second verification factor that attackers can't easily steal or replicate. Even if a phishing attack captures a user's password, the attacker still can't access your workspace without the victim's phone or security key. Conditional Access policies let you require MFA selectively based on risk—enforce it for all workspace access, or limit the requirement to high-risk scenarios like connections from unfamiliar locations.
+Password-based authentication provides weak protection for AI infrastructure containing sensitive training data and proprietary models. Multifactor authentication (MFA) adds a second verification factor that attackers can't easily steal or replicate. Even if a phishing attack captures a user's password, the attacker still can't access your workspace without the victim's phone or security key. Conditional Access policies let you require MFA selectively based on risk—enforce it for all workspace access, or limit the requirement to high-risk scenarios like connections from unfamiliar locations.
 
-Implementing MFA through Conditional Access requires creating a policy that targets your Azure Machine Learning workspace. Start by selecting the Azure Machine Learning application as the target resource. Choose which users or security groups the policy applies to—you might enforce MFA for the ML Engineers group while exempting read-only analysts in low-risk scenarios. Under access controls, select "Require multi-factor authentication" as a grant condition. This configuration prompts users for a second factor during sign-in, with the verification persisting for a configurable session duration. Most organizations set this to eight hours, balancing security with usability—users authenticate once per workday rather than with every experiment submission.
+Implementing MFA through Conditional Access requires creating a policy that targets your Azure Machine Learning workspace. Start by selecting the Azure Machine Learning application as the target resource. Choose which users or security groups the policy applies to—you might enforce MFA for the ML Engineers group while exempting read-only analysts in low-risk scenarios. Under access controls, select "Require multifactor authentication" as a grant condition. This configuration prompts users for a second factor during sign-in, with the verification persisting for a configurable session duration. Most organizations set this to eight hours, balancing security with usability—users authenticate once per workday rather than with every experiment submission.
 
 ## Require compliant devices for data protection
 
-Multi-factor authentication protects credentials, but it doesn't prevent data exfiltration from compromised devices. A data scientist's laptop infected with malware can steal training data or model weights even after successful MFA. Device compliance requirements address this gap by verifying that endpoints meet your security baseline before granting workspace access. Microsoft Intune policies define compliance criteria: devices must run supported operating systems, have encryption enabled, maintain current patches, and run approved endpoint protection software.
+Multifactor authentication protects credentials, but it doesn't prevent data exfiltration from compromised devices. A data scientist's laptop infected with malware can steal training data or model weights even after successful MFA. Device compliance requirements address this gap by verifying that endpoints meet your security baseline before granting workspace access. Microsoft Intune policies define compliance criteria: devices must run supported operating systems, have encryption enabled, maintain current patches, and run approved endpoint protection software.
 
 :::image type="content" source="../media/multi-factor-authentication-protects-credentials.png" alt-text="Diagram showing how Microsoft Intune policies define compliance criteria.":::
 
@@ -44,4 +44,4 @@ Configure session controls based on risk and resource sensitivity. For high-risk
 
 - [What is Conditional Access?](/entra/identity/conditional-access/overview) - Overview of Conditional Access capabilities and architecture
 - [Conditional Access for Azure Machine Learning](/azure/machine-learning/how-to-setup-authentication#conditional-access) - Service-specific implementation guidance
-- [Plan a Conditional Access deployment](/entra/identity/conditional-access/plan-conditional-access) - Best practices for policy design and rollout
+- [Plan a Conditional Access deployment](/entra/identity/conditional-access/plan-conditional-access) - Best practices for policy design and rollout