Can Service Providers tell Azure IDP not to allow KMSI?

Dan 1

Is there a way for a SAML2 Service Provider to communicate to Azure IDP that it doesn't want KMSI to be allowed for an authentication request?

Akshay-MSFT 16,036 Reputation points Microsoft Employee

2022-12-12T06:22:59.2+00:00

Hello @Dan

Hope you got a chance to review the action plan suggested below. Please do let me know if you have any queries in the comments section. If you don't have any further queries and the suggestion works as per your business need. Please "Accept the answer" and "Upvote". This will help us and others in the community as well.

Thank,
Akshay Kaushik

1 answer

JimmySalian-2011 41,921 Reputation points

2022-11-27T20:39:21.237+00:00

Hi Dan,

AFAIk, KMSI is configurable at the individual user flow level.When you enable the feature, users can opt to stay signed in so the session remains active after they close the browser. The session is maintained by setting a persistent cookie. I guess you will have to customize the policy .

Check this excellent write up on the KMSI.tips-and-tricks-for-working-with-custom-policies-in-azure-ad-b2c-eb63b508a075

Hope this helps.
JS

==
Please Accept the answer if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
Dan 1 Reputation point

2022-11-27T20:56:10.687+00:00

I was hoping there was a way for the Service Provider to specify via a SAML parameter that we don't want to allow KMSI, similar to ForceAuthN. ex. <Item Key="AllowKMSI">false</Item>

We have an application that has strict security requirements. We set ForceAuthN, which essentially disables KMSI, but users are still get the KMSI prompt and it adds an extra prompt during authentication that is pointless when ForceAuthN is set.

JimmySalian-2011 41,921 Reputation points

2022-11-27T21:16:12.96+00:00

Ah check this thread with some options to disable it in the code.azure-ad-b2c-custom-policy-with-kmsi-auto-signin-not-working-after-browser-clos

Hope this helps.
JS

==
Please Accept the answer if the information helped you. This will help us and others in the community as well.
Sign in to comment