Setup MFA Exclusion but It is not working

Question

Setup MFA Exclusion but It is not working

BmoreOs 141

We have an account that we would like to use to send email notifications for a SaaS app. We input the SMTP settings and credentials for this account. MFA is excluded but errors occur. When logging into this account, MFA continues to ask for registration. I followed the below guide on how to setup exclusions, but it is not working.

[https://learn.microsoft.com/en-us/azure/active-directory/governance/conditional-access-exclusion

I saw one note to look under Security - Identity Protection but that is off due to us not having P2. Any ideas why this isn't working?

3 answers

Your answer

Answer 1

BmoreOs 141

Appreciate the help @Luke Murray

Can't say that I am an expert so going slow with this. I tried to setup a policy that would exclude the My Signins app but it is not in any search I complete. I am hesitant on allowing all cloud apps as I know this account is tied to various things and I want security to remain for those.

Our main conditional access policy requires MFA for all users, excluding one group with two accounts in it. That is working based on the screenshot above. I am little confused on how I would setup the additional policy strictly for the My signins app and those two user accounts. I would apply it to no users and only exclude the exclusion group...but that won't work with our original policy. Is there no way to exclude a group from MFA and a single app? Is it all apps or no apps tied to all users or no users? I have the ability to exclude a group from the policy but the ability to exclude certain apps for certain people.

I read that Microsoft is getting rid of "App Passwords" to bypass MFA completely on 3/31, and it sounds like April Fools' Day is going to be terrible for those who are unaware. Hopefully I can figure this out to fix the SSO and data migration issues.

Luke Murray 11,436 Reputation points MVP Volunteer Moderator

2023-01-27T17:47:25.8433333+00:00

Try adding the account to the MFA exclusion list, then create another policy to enable MFA for everything for that specific account, excluding the IP address (location) you are testing from - then we can see if conditional access is the problem.

The What-if tool can be helpful here: [https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/what-if-tool
William Wilson 0 Reputation points

2023-02-13T15:06:39.5966667+00:00

@BmoreOs I'm having similar issues whilst trying to develop some new CAPs.

I have a set of master policies broadly split between corporate and BYOD endpoint use cases; plus separate User Action policies to control (and block) 'Register security information' events. I've also setup the Temporary Access Pass and assigned Fido key option to the test group. However, from the sign-in logs, it looks like the application level policies are taking precedence, yet there is no 'My Signins' application to add an exception for.

Interestingly, the What If tool doesn't seem to cover this type of situation as it also doesn't think the My Signins application exists and says that my policies should work as designed.

Did you find a solution for this that doesn't involve opening various holes in your CAPs?

Answer 2

Luke Murray 11,436 MVP Volunteer Moderator

For Conditional Access, have a look at What if, and run through that account - it should indicate what policy could be effecting it.

https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/what-if-tool

Also check Per-User MFA and make sure this is turned off:

https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates

BmoreOs 141 Reputation points

2023-01-27T03:29:22.1833333+00:00

@Luke Murray Thanks. I tried the What If, didn't seem to work. I then went into Per User MFA and I get: You do not have sufficient permission to access this page. Error 1051, despite being a global admin.
Luke Murray 11,436 Reputation points MVP Volunteer Moderator

2023-01-27T03:33:06.0233333+00:00

Hmm - is Security defaults on or off?

[https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults#enabling-security-defaults
BmoreOs 141 Reputation points

2023-01-27T03:35:08.07+00:00

I was able to get in via an InPrivate page. All are set to disabled. Along with the SaaS email issue, I cannot migrate any email/drive data from a company we acquired because I cannot bypass MFA for one single account. I do not want to disable MFA for the whole tenant as their support suggested.

Answer 3

BmoreOs 141

Digging more. I found this under the user sign ins. What is "My Signins" and how do I bypass that for just this account? I don't want to impact all users. Thanks

User's image

Luke Murray 11,436 Reputation points MVP Volunteer Moderator

2023-01-27T04:02:28.16+00:00

Create a new Conditional Access policy for that user, to exclude MFA for MySignIn (or all) applications.

https://learn.microsoft.com/en-us/azure/active-directory/governance/conditional-access-exclusion
William Wilson 0 Reputation points

2023-02-13T15:09:08.2233333+00:00

@Luke Murray unfortunately, there does not appear to be an application 'My Signins' and I've also tried searching for it by Application ID.
ali@alicain.com 0 Reputation points

2025-01-23T10:46:12.6166667+00:00

I am also experiencing this issue - has anyone managed to resolve it?

Share via

Setup MFA Exclusion but It is not working

3 answers

Your answer