MFA sign-in request approval pops up every day in Azure Virtual Desktop enviroment

Cloud_Geek_82 831

Hi All,

A company recently migrated from Citrix XenApp to Azure Virtual Desktop environment.

Now 2 users get Microsoft MFA sign-in request approval popping up every day when they open Outlook \ OneDrive or Teams.

What could be a reason of that?

Prrudram-MSFT 22,941 Reputation points

2024-05-29T10:37:44.4066667+00:00

HI @Cloud_Geek_82

Are their hosts hybrid joined? Do they have CA policies applied that require MFA? If yes, are there conditions that aren’t met by the session hosts?
Cloud_Geek_82 831 Reputation points

2024-05-29T10:45:52.0766667+00:00

Hi @Prrudram-MSFT

The organization indeed has all cloud apps protected by MFA.

This however, doesn't explain why only two users get MFA prompt popping up every day if all users works on the same AVD server.
Prrudram-MSFT 22,941 Reputation points

2024-05-29T11:02:07.32+00:00

Hi @Cloud_Geek_82

Sign in logs in Entra may shed some light as to why they're getting MFA'd, too. The sign in logs for those users should give an indication. Maybe those are in different groups?

The logs will lead you, but as "a guess" - there are some 'legacy' settings to mark users as 'Enforced' for MFA (which basically will trigger MFA with every new auth) - I'd check to see if they're set to 'Enforced' for MFA: Enable per-user multifactor authentication - Microsoft Entra ID | Microsoft Learn This might help narrow it down, too - Configure adaptive session lifetime policies - Microsoft Entra ID | Microsoft Learn

1 answer

Cloud_Geek_82 831 Reputation points

2024-06-04T08:54:04.6766667+00:00

Hi All,

I noticed the issue happens in RDS environment with user profile disks.

In other words if in RDS environment user profiles are stored on session hosts they don't get MFA prompt every day.

However, in RDS environment where user profiles are stored centrally as UPD disks this is when this started to happen.

If anyone could shed some light why it is so and how to fix it that would be much appreciated.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment