How to enable MFA for particular request in Azure AD B2C custom policies

Question

How to enable MFA for particular request in Azure AD B2C custom policies

Mikhail Baluev 1

I have configured two sugn-up-sign-in custom policies in Azure AD B2C, one with MFA enabled, and one with MFA disabled.
And I want to login without MFA, but for some kind of requests to backend I need to acquireToken with calling MFA. I found topics that describes that in this case I should acquireToken with custom policy configured with MFA, so when I do this I have redirected to page with phone verification and after successful code entry there is a new user session created, so I have two different sessions for one user.

How should I corretly configure my custom policies to work with same session? Is it possible?

1 answer

Your answer

Answer 1

AmanpreetSingh-MSFT 56,871 Moderator

Hi @Mikhail Baluev • Thank you for reaching out.

To make it work with the same session, I would suggest you use the same custom policy rather than using two different signup/sign-in policies and update the pre-condition in the user journey to determine whether to trigger MFA or not in the given scenario.

In this thread, I have provided details on triggering MFA only when it is not already done at the federated Azure AD tenant. You can follow a similar approach and define a precondition to trigger or skip MFA.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Walid Ghodhbani 20 Reputation points

2023-06-12T11:08:30.39+00:00

Hello @AmanpreetSingh-MSFT ,

I hope you are doing well! I'm totally new to custom policies and I read your answer and it gives me insights to do what we are trying to achieve.
I have an MFA Sign In policy with phone or email and it works fine, however we have a special preference to add: The mfa policy should be disabled by default and a user can enable/ disable it from our UI. I see you said : "update the pre-condition in the user journey to determine whether to trigger MFA or not in the given scenario."
I'm a bit confused and I want to know how to set the mfa to false by default and how to update it to true as a claim when the user set it in the UI?

Would you please give me an example?

In case you want to have a look on the custom policy: netronicjpi.onmicrosoft.com-B2C_1A_DEMO_SIGNUP_SIGNIN_PHONEOREMAILMFA.xml

Your help is much much appreciated!

Share via

How to enable MFA for particular request in Azure AD B2C custom policies

1 answer

Your answer