Audit log found of MFA Enforced users sign-in through Single Sign On

Question

Hi,

I've seen a Azure AD sign-in risk alert for a user. While checking, there is found multiple Sign-in log failures for that user via Single Sign on and a successful sign in logs for the same user via Single Sign on. But the user is enforced to use MFA and also there is no any kind of Conditional Access Policy.

How can someone MFA enforced user sign in via Single Sing on ?

An urgent support needed.

Answer 1

@JanakKhadka

Thank you for posting your query.

From above description and screenshot I could understand that why end user is able to sign in via SSO when MFA is enforced.

Please do correct me if there is any discrepancy in my understanding by responding in the comments section.

The Azure AD default configuration for user sign-in frequency is a rolling window of 90 days, this means user will be prompted to reauthenticated after 90 days.

In Office clients, the default time period is a rolling window of 90 days. With this default Office configuration, if the user has reset their password or there has been inactivity of over 90 days, the user is required to reauthenticate with all required factors (first and second factor).

MFA is triggered only when user would be prompted for authentication, if session is not expired (due to rolling session), MFA would not be initiated.

Solution:

To control the user sign-in frequency and ensure user is prompted for MFA more frequently, you must configure a Sign-in frequency control or Sign-in frequency control every time risky user

Please do let me know if you have any further queries.

Thanks,

Akshay Kaushik

Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.