CODEWITHSUNDEEP
azureazure-active-directorymulti-factor-authentication
toto'
toto'

Reputation: 1574

Azure AD MFA is not deterministic

I am using Azure services and Azure AD Free (my personal account). I have setup a tenant and I am Global Admin. I have enabled Security Default in the tenant. Hence, I assume MFA is enabled for all the tenant's users. When I signin to Azure Portal with Global Admin sometime I get not prompted for MFA; maybe is this because the browser send a cookie? Or maybe because MFA is not always triggered? Also, if I open an incognito window I get prompted for a code, received via email. My question here is why email? As per MFA AAD doc the email method is NOT an MFA channel!

Upvotes: 0

Views: 702

Answers (1)

Sridevi
Sridevi

Reputation: 22412

Please check if below are the reasons behind not getting the prompt for second verification even MFA is enabled:

  1. Please check if you are a member of any exception group. To avoid lockout situation, Microsoft mostly suggest excluding global admin account while enabling MFA. If you done like that, remove your account from exception group.
  2. There is also a possibility where you selected checkbox saying “Stay signed in” while logging into your account. Then it will treat your device as remembered device and suspends enabling MFA. Also please check below screenshot whether you have enabled this option (Remember MFA on trusted device). If you enabled that, you won’t get prompts until the duration of days you have given expires.

1

To remove all those sessions, enable “Revoke MFA sessions” which clears all remembered sessions history and asks for second verification.

2

As you already mentioned, MFA code won’t be sent via email.

From this Microsoft Doc,

Email address is only used for Self-Service Password Reset (SSPR) not for authentication.

There is also a possibility where your password is expired and it’s sending you a code to your email to reset it as you have given it as recovery option.

NOTE:

As you are enabling Security Defaults, please note that you won't be getting MFA prompts every time. Azure AD decides when a user will be prompted for MFA, based on factors such as location, device, role and task.

For suppose, if you are accessing from different location and seemed suspicious means, definitely you will get prompt otherwise you won't. If you need MFA prompts in particular, make use of Conditional access policies that need Azure AD Premium licenses.

Upvotes: 1

Related Questions