Using Two-Factor Authentication

Lync Server 2013 does not provide support for any kind of two-factor authentication such as smart cards or security tokens. Instead, remote Lync clients provide NTLM credentials over the secure SSL channel during the initial sign-in, and then use a certificate created by the Lync Front End Servers for any subsequent sign-ins. The certificate is specific to the remote endpoint and is stored locally to expedite the sign-in process for future logins. This also means that any home user with Lync installed on a personal PC can enter her Active Directory credentials to sign in to Lync remotely.

Some organizations have security mandates that require two-factor authentication for any form of remote access, and Lync is unable to meet those mandates. To meet these requirements, a business can still deploy Edge Servers to support federation or PIC but disallow remote access for Lync users through a policy. This forces a user to first establish a VPN connection that requires two-factor authentication, and then Lync can connect to the internal Front End Servers. There are some serious disadvantages to this approach with regard to the media quality discussed later in this chapter.

When discussing remote access, organizations should follow these guidelines:

• Determine whether remote access will provide additional value to the Lync deployment.

• Identify which users should be configured for remote access, and then create appropriate access policies to assign to end users.

• Determine whether two-factor authentication is a security requirement, and if so, identify the maturity of the deployed solution and any current issues.