Enterprise application not prompting for MFA

dirkdigs 921

How can i force my enterprise application (using SAML auth) to prompt for MFA every time ?

i tried creating a conditional access policy but that did not work .

I found this blurb from 2019 - this seems like the exact same issue . is this still the case 3 years later?

I just don't feel 100% comfortable with there not being a way to enforce 2FA even if the device is hybrid joined and is still within the 14 day Primary Refresh Token window.  It feels like with conditional access being an option I should be able to override the token in the event the user attempts to access this specific application.

Is there a way to reset this Primary refresh token .

Azure AD Conditional Access policies are not evaluated when PRTs are issued.

1 answer

Alfredo Revilla - Senior Freelance SWE, SWA, IAM 27,016 Reputation points

2022-05-19T04:23:00.13+00:00

Hello @dirkdigs , you can enforce re-authentication and MFA using User sign-in frequency for the specific application.

Let us know if this answer was helpful to you or if you need additional assistance. If it was helpful, please remember to accept it so that others in the community with similar questions can more easily find a solution.
Please sign in to rate this answer.
dirkdigs 921 Reputation points

2022-05-19T13:15:08.147+00:00

it does not allow me to use the "every time" option
i am using a non-gallery application and the purpose of my app is for remote access vpn .
naturally i prefer to have MFA prompt for All logins .
Is there another way i can accomplish this?

Alfredo Revilla - Senior Freelance SWE, SWA, IAM 27,016 Reputation points

2022-06-02T17:48:34.003+00:00

Hello @dirkdigs , apologies for the delay. Currently Require reauthentication every time (preview) supports selected apps (Eg. Microsoft Intune Enrollment) or all apps. You might try with "all apps" adding additional requirements such as device, location, user, groups or others.

dirkdigs 921 Reputation points

2022-06-15T20:10:59.37+00:00

@Alfredo Revilla - Senior Freelance SWE, SWA, IAM

Hi , We are noticing that with the sign-in frequency set to 1 Hours that the application will disconnect and request a re-authentication . Now since the application is a VPN software this is not very good. It will disconnect a user in the middle of a working sessions.

Any suggestions?
Any Alternative?

SanchK 1 Reputation point

2022-08-04T11:17:54.447+00:00

@Alfredo Revilla - Senior Freelance SWE, SWA, IAM do you have any news on the availability of the "User sign-in frequency" "every time" option for other apps ?
I have exactly the same case as @dirkdigs : need to require MFA every time for a VPN Azure registered App.
Thank you.

Alfredo Revilla - Senior Freelance SWE, SWA, IAM 27,016 Reputation points

2022-11-24T22:24:01.947+00:00

Hello @dirkdigs , the VPN getting disconnected depends on the VPN provider before anything else. What provider is this?

Alfredo Revilla - Senior Freelance SWE, SWA, IAM 27,016 Reputation points

2022-11-24T22:31:11.473+00:00

Hello @SanchK , currently there's no update for additional app supported by "every time", however you can let the product team know about your interest posting a new Idea in the Azure Feedack Forum.
Sign in to comment