force authentication by Azure AD

Question

Hello,

In context SAML authentication,

If the Service Provider (SP) requires the user to undergo a fresh authentication, it can send a SAML request with ForceAuthn="true"

The meaning of ForceAuthn="true" is, SP is telling Azure-AD that even though the user is already authenticated in the past and the request has come with PRT/cookie, still Azure-AD must do the fresh authentication again.

So my question is, is this functionality supported by Azure-AD as IDP ??

Thanks.

Answer 1

Yes. [https://learn.microsoft.com/en-us/azure/active-directory/develop/single-sign-on-saml-protocol#authnrequest

Answer 2

Thanks @Mark Morowczynski

I guess we have to take help of ForceAuthn until MS expands the list of apps under the purview of  Sign-in-frequency=every-time

Just getting a little greedy, can we force user ONLY to do second-factor authentication ??

Answer 3

Thanks @Mark Morowczynski

I guess we have to take help of ForceAuthn until MS expands the list of apps under the purview of  Sign-in-frequency=every-time

Just getting a little greedy, can we force user ONLY to do second-factor authentication ??

Answer 4

I'm going to challenge you to think about this a bit differently. Take a look at the AAL levels, [https://learn.microsoft.com/en-us/azure/active-directory/standards/nist-about-authenticator-assurance-levels. As we as Auth strengths, [https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-strengths. If you think about classifying applications based on required strength to get access, that should be required EACH time.

Right now you are saying to get access to App X the first time would require 2 Factors but getting access the 2nd, 3rd, Nth time you only want to do the "Second Factor" which I'm guessing you mean to be a Non-Password based auth. Would that meet the auth strength requirement you set for the application based on how sensitive/important/risky the app is to the business?

Answer 5

As I am holistically studying your pointers, I have one important point to hash out.

With the advent of Conditional Access authentication strength (AS) , how does it play out

for eg., I access a resource which is protected by AS1 (can be fulfilled by TAP) and after a few minutes, I access another resource which is protected by AS2 (can be fulfilled by password+SMS )

Now we all know that TAP is stronger than SMS, however, my understanding is, user has to undergo password+SMS

Am I right ?

And secondly, how various authentication strengths (AS) plays out with SIF Earlier only one MFA-instant time was required to be stamped in the PRT or cookie.

But now, will my PRT be stamped with individual, separate instance times for every method that I used to fulfill the authentication strength required by the resource ??

Appreciate your clarification.