My users are not being automatically assigned to my Duo EAM authentication method. This used to work.

Question

My users are not being automatically assigned to my Duo EAM authentication method. This used to work.

Andrew Hancock 10

My organization uses Duo for MFA and we have had this configured in Azure since 2024 using the Duo MFA for Microsoft EAM instructions here: https://duo.com/docs/microsoft-eam

We have a hybrid-AD environment and create all users initially in our on prem AD which then syncs to Azure and Duo. Today I discovered that the Duo MFA EAM is not being automatically being added as an authentication method to new users and, as we only want to pester user to setup one MFA method, those users have no MFA because the conditional access policies fail open and not closed. The Cisco Duo EAM is targeted to all users and until recently it was automatically added to all users as an authentication method. I need to get this functionality restored so that we don't have users that can login without MFA. I'm sure more troubleshooting data will be needed so let me know what that is. Thanks in advance.

0 comments

2 answers

Your answer

Answer 1

Andrew Hancock 10

I don't see where its an assignment or provisioning problem, the Duo EAM enterprise app is enabled and assignment is NOT required. Like I mentioned, this used to work flawlessly and I have had no reason to touch anything related to the Duo/Azure/MFA configs. Something, in my opinion, has changed on Microsoft's side of things.

Edit - Spelling

HanVD 0 Reputation points

2026-02-02T13:47:00.5733333+00:00

Having the same issue, did you get any progress?
Wasserberg, Jason 0 Reputation points

2026-02-20T22:21:12.0366667+00:00

I've noticed the same issue. Have you found anything out?
Andrew Hancock 10 Reputation points

2026-02-20T22:31:28.1433333+00:00

Unfortunately there has been no response from Microsoft. Since creating this post I've opened 3 separate Microsoft support cases but they won't even respond there. There is a ton of liability Microsoft is taking on by failing to meet their promised response times and to address security issues like this!
Wasserberg, Jason 0 Reputation points

2026-02-20T22:37:33.5366667+00:00

At least I know others are experiencing the same thing. I was beginning to think I was crazy because I swore the External authentication method used to happen automatically.

Right now I'm going into the each new user we create and manually assigning our external authentication method.
Andrew Hancock 10 Reputation points

2026-02-20T22:47:24.6866667+00:00

I spent many hours troubleshooting it, double checking configurations, creating test users, etc... only to come to the conclusion its a Microsoft issue. I even called Duo, even though it is not their issue, to see if they had any guidance but they couldn't help. I've resorted to the same process as you and am manually assigning the authentication method.

Times like this are when I most wish we had an alternative to Microsoft!
Wasserberg, Jason 0 Reputation points

2026-02-24T16:18:54.9933333+00:00

I created a new Duo application for Entra and Entra authentication policy in the hopes that I'd see new users added to the policy automatically. Unfortunately that did not change anything
Jose Cerna 0 Reputation points

2026-03-06T07:41:58.38+00:00

Yes something did change, were you able to find a solution?
Andrew Hancock 10 Reputation points

2026-03-06T15:09:30.4133333+00:00

No solutions yet. Microsoft has still not answered my support tickets and I haven't found a workaround.
Wasserberg, Jason 0 Reputation points

2026-03-06T15:24:44.72+00:00

The workaround I use for now is to manually add the authentication option to new users we create.

Answer 2

To troubleshoot the issue of users not being automatically assigned to the Duo EAM authentication method in your Azure environment, consider the following steps:

Check User Assignments: Ensure that the users are correctly assigned to the Duo EAM application in Azure. Users and groups must be assigned to the application for provisioning to occur. You can verify this by checking the assignment settings in the Azure portal.
Attribute Mappings: Confirm that the attribute mappings are correctly configured to sync valid attributes from Microsoft Entra ID to the Duo application. If the mappings are not set up correctly, users may not be provisioned as expected.
Provisioning Logs: Review the provisioning logs in the Microsoft Entra admin center. These logs will provide insights into what operations have been performed by the provisioning service and whether there were any errors during the provisioning process. Look for log entries related to the users who are not being provisioned.
Scoping Filters: Check if there are any scoping filters in place that might be preventing certain users from being provisioned. Scoping filters can restrict which users are eligible for provisioning based on specific attribute values.
Duo Configuration: Ensure that the Duo application is properly configured in Azure and that it has the necessary permissions. If the application does not have consent approved, sign-ins using the Duo method will fail.

If you have checked all the above and the issue persists, you may need to gather more specific logs or error messages to further diagnose the problem.

References:

Share via

My users are not being automatically assigned to my Duo EAM authentication method. This used to work.

2 answers

Your answer