Share via

Azure AD Conditional access

robcool 116 Reputation points
2022-09-28T03:00:27.027+00:00

I have conditional access policy set to challenge users for MFA.

However, they aren't prompted and moreover when I check the sign-in logs it shows "Success" for that CA policy with additional message saying "MFA requirement satisfied by claim in the token"

Can someone please confirm what could be the issue here ? Why is the MFA token retained and users not challenged for second factor ?

Azure Policy
Azure Policy
An Azure service that is used to implement corporate governance and standards at scale for Azure resources.
1,014 questions
Microsoft Security Microsoft Entra Microsoft Entra ID

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Dillon Silzer 57,826 Reputation points Volunteer Moderator
    2022-09-28T04:32:51.683+00:00

    Hi @robcool

    If you want to be frequently challenging them you can set a session timeout Conditional Access Policy:

    Policy 1: Sign-in frequency control

    https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime#policy-1-sign-in-frequency-control

    --------------------------------

    If this is helpful please accept answer.

    1 person found this answer helpful.
  2. Vasil Michev 119.5K Reputation points MVP Volunteer Moderator
    2022-09-28T06:07:27.957+00:00

    How exactly is the user authenticating? There are scenarios, such as when logging in from a Azure AD joined device via PRT, where MFA requirements are automatically satisfied. Read for example here: https://learn.microsoft.com/en-us/azure/active-directory/devices/concept-primary-refresh-token#when-does-a-prt-get-an-mfa-claim
    Some federation scenarios count as well.

    1 person found this answer helpful.
    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.