User Sign In logs, show Single-factor authentication for Windows Sign In

Question

We have some Azure users showing failures on "Single-factor authentication" every day.

We have disabled all per user MFA, enforced users with conditional access policies.

However, we still see the "Single-factor authentication" failure in some users sign logs.

Authentication requirement :Single-factor authentication

Authentication method : Windows Hello for Business

Sign-in error code : 1400001

Failure reason : Request nonce is not provided.

signlog.jpg

signlog2.jpg

signlog3.jpg

signlog4.jpg

Answer 1

Hi,

Have you check if user account is getting locked out during that period? Is this particularly from single device or multiple device users tried login? I suspect any configuration issues in user profile causing multiple attempts and giving this errors.

Answer 2

@HellowWord Thank you for reaching out to us, As I understand you are investigating on this

Sign-in error code : 1400001 Failure reason : Request nonce is not provided. & Authentication method : Windows Hello for Business

This happens/expected when users can provision WHfB (windows hello for business) credentials, but when they attempt to use them to acquire a PRT, sign-in fails.

Do you have Windows hello configured in the environment? if yes can you help what kind of configuration is deployed in your environment - https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/deploy/

Do you see for all users the above mentioned error code in the sign in logs?

Let me know if you have any questions, feel free to post back.