Share via

MFA Still Required on Android but not on Windows

Jason Kowalczyk 6 Reputation points
2022-12-13T22:30:05.86+00:00

I have an account, in a tenant that has Security Defaults off. We have Conditional access enabled, but have excluded the user in question from MFA.

When I login via a Crestron Teams Panel (android based) it continues to ask for "additional info" to enroll in MFA every time it logs in.

When I login via an Incognito window it does not require MFA, or MFA enrollment.

Does anyone have any thoughts on this issue?

Microsoft Intune Android
Microsoft Intune Android
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Android: An open-source mobile platform based on the Linux kernel, developed by Google, and maintained by the Open Handset Alliance.
242 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,852 questions
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jason Kowalczyk 6 Reputation points
    2022-12-30T16:56:55.983+00:00

    So what I found out was this was a setting in AAD under devices that required devices to ask for MFA to register with AAD.

    Security Defaults being off do not turn this part off, but MS recommends using Conditional Access to enable it.

    You can access it by going to Devices -> Device Settings in the AAD portal.

    275038-image.png

    1 person found this answer helpful.
    0 comments
  2. Dillon Silzer 54,831 Reputation points
    2022-12-14T02:02:24.193+00:00

    Hi @Jason Kowalczyk

    Please ensure that your Conditional Access policy is enabled for All cloud apps as seen below:

    270256-image.png

    ------------------------------

    If this is helpful please accept answer.

  3. Marilee Turscak-MSFT 34,786 Reputation points Microsoft Employee
    2023-01-03T23:36:40.037+00:00

    Hi @Jason Kowalczyk ,

    I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others", I'll repost your solution in case you'd like to "Accept" the answer.

    Issue:

    In a tenant where Security Defaults were disabled, MFA was still being required for an Android user. Conditional Access was enabled, but the user was excluded from MFA. Yet the user was still prompted for MFA.

    Resolution:

    Setting Require Multi-Factor Authentication to register or join devices with Azure AD to No under Devices > Device settings resolved the issue. Turning off Security Defaults does not disable this setting, so users would still be prompted for MFA.

    Let me know if this accurately describes your resolution and if you questions or run into any issues. Thank you again for your time and patience throughout this issue.

    -
    If the information provided accurately summarizes your solution, please consider Accepting the answer. This will help improve discoverability for others in the community who might be researching similar information.

    0 comments