MFA session doesn't work in Azure B2C custom policy

Vasilii Aleksandrov 11 Reputation points
2020-08-18T15:52:25.563+00:00

I used a b2c starter pack to create my MFA B2C sign in policy with phone number as a factor. But for some reason it doesn't work as expected. First time when I sign in it work fine - the policy is asking me to verify my sign in via SMS and then I got a token. But when I run the flow immediately after my 1st sign in, it shows the same phone verification page while it shouldn't. I expect that it should silently sign me in without phone verification. So looks like MFA session is invalid. How to fix that?

Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
2,639 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,457 questions
0 comments

5 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. AmanpreetSingh-MSFT 56,306 Reputation points
    2020-08-19T07:50:48.913+00:00

    Hi @Vasilii Aleksandrov

    The SocialAndLocalAccountsWithMfa starter pack by default includes the Sessions Manager technical profile which facilitates SSO if you have already signed into the same browser session. However, if your authentication request includes prompt=login parameter you will be forced to perform login again regardless of whether you have an active session and session cookie or not.

    If you are using the Run Now endpoint, prompt=login parameter is specified by default at the end of the URL. If you have an active session and you try to sign-in using custom policy in a new tab within same browser session without prompt=login, you will be directly signed-in without having to enter the credentials and perform MFA again.

    -----------------------------------------------------------------------------------------------------------

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    2 people found this answer helpful.
  2. Bhanot Ravi 31 Reputation points
    2020-08-18T16:17:19.217+00:00

    Hi, I would recommend to Evaluate session lifetime policies, please use below URL for reference:-

    https://learn.microsoft.com/en-us/azure/active-directory/authentication/concepts-azure-multi-factor-authentication-prompts-session-lifetime

    In case after following the steps, still issue persists, please do mention.

    Thanks,
    Ravi

    1 person found this answer helpful.
  3. Mepani Arvindkumar Vishram 1 Reputation point
    2020-10-29T15:35:59.17+00:00

    @AmanpreetSingh-MSFT
    For mfa-email-or-phone custom policy how to configure MFA Session to skip MFA Prompt for Every sign in?

    When I am testing Policy on Azure AD B2C Portal it will always prompt MFA dialog for both Email and Phone method,
    How can we configure and Test MFA Session?

    I am not sure what I am missing.

    Thanks in advance for any suggestion

  4. Mepani Arvindkumar Vishram 1 Reputation point
    2020-11-17T01:43:54.953+00:00

    Hi @Vasilii Aleksandrov ,
    If possible could you please share your custom azure ad b2c policy.

    So, I can take a look and try atleast some configuration my policy to test MFA behaviour.

    0 comments
  5. Mantravadi, Phani 1 Reputation point
    2022-05-18T19:04:21.223+00:00

    Great topic and awesome responses.

    Is there a way to invoke MFA separately after login?

    When user tries to access specific features I'd like to invoke the MFA step again. Is that possible to do using AD B2C Custom policies? I'm trying to invoke MFA only for specific parts of my application. I'd like my user to be able login based on password + mfa that only allows read-only access to more secure aspects of the site.

    0 comments