How to enable MFA (mobile authenticator) conditional access on a B2C client for select users while not requiring users without MFA to register an authenticator

Matthew Beckett 0

We are attempting to roll-out MFA for specific users on our B2C tenant, these users are within their own groups and within a conditional access policy where they have the MFA grant enabled.

We have set our Sign Up / Sign In userflow to conditional MFA.

We have disabled security defaults on the tenant.

The problem: when the user flow is run, all users even if explicitly excluded from the policy are still prompted to register the authenticator app and they are unable to proceed until they have done so.

Once this has been done, it will no longer prompt them to register the application.

We wish that the users are not prompted to register until we have included them in the conditional access policy.

We have since tried amending the 'Multifactor authentication registration policy' to prevent this but this seems to have also had no effect. Any help would be greatly appreciated.

Akshay-MSFT 17,866 Reputation points Microsoft Employee

2023-09-19T11:04:53.04+00:00
@Matthew Beckett

Thank you for posting your query on Microsoft Q&A, from above description I could understand that you want to target a set of users with MFA via Authenticator app for signin , however itis impacting all users.

Please do correct me if this is not the case by responding in the comments section.

Could you please share the following for me to validate the policy:

Screenshot of Registration Campaign policy:

Complete screenshot of conditional access policy.

Thanks,

Akshay Kaushik
Matthew Beckett 0 Reputation points

2023-09-19T11:29:31.2333333+00:00

Hi @Akshay-MSFT ,

Yes, you're correct. The issue is that while we wish to enable 2FA for a very limited group and have them register, all our other users who are specifically excluded are also being asked to register a 2FA app and cannot proceed to the platform until they have done so.

This is from our testing tenant, we are unable to get it to work here either.

I have tried the policy being enabled, disabled, Managed, nothing has prevented the registration prompt for appearing for all users who currently do not have MFA.

(I have been waiting 10 minutes between the changes to allow them to propagate, as we've noticed it's not instant)

We weren't previously using the registration campaign, we just used security defaults disabled with just conditional access and user flows set to conditional. however, no changes we have made have changed the result other than setting MFA to disabled on the user flow.

We have changed settings and been struggling to get this to work for some time. Having changed numerous settings. I have changed our 'Feature Tier' on the tenant from Premium1 to Premium2 from the main directory but this didn't seem to affect anything either.

While it says that under the 'Entra ID' area it does say we only have AD free if this is also relevant.

Thanks for your help,

Matt.
Akshay-MSFT 17,866 Reputation points Microsoft Employee

2023-09-22T08:28:53.0466667+00:00

@Matthew Beckett

Thanks for your response could you please confirm if you are using Signup-Signin flow with MFA?

If yes, then please try turning it off and confirm the behavior.

Thanks,

Akshay Kaushik
Matthew Beckett 0 Reputation points

2023-09-25T06:54:15.72+00:00

@Akshay-MSFT

Hi Akshay,

We currently have the Sign-Up/Sign-In's MFA disabled. (As opposed to on or conditional)

The conditional access policy is still enabled. However, this doesn't apply the policy.

We had tried this before but suspected this wasn't supposed to work as there is the 'Conditional' state for the policies.

This is currently not prompting any users, including those explicitly stated in the conditional access policy, to register with MFA.

When it is set to 'On', it does require all users to use MFA.

When set to 'Conditional', while it does only require those who are explicitly stated to use MFA, it does also require all other users to register for MFA and they cannot proceed onto the platform without doing so.

This might not sound like the worst outcome but unfortunately, we are in a situation where that isn't acceptable from us and so we're stuck in a bit of a limbo as some specific organisations we work with do wish this to be enabled.
Akshay-MSFT 17,866 Reputation points Microsoft Employee

2023-10-13T09:04:00.6533333+00:00

@Matthew Beckett

Thanks for your response, I was able to dig more and found that this has been by design.

As per Set multifactor authentication With general availability of Conditional Access in Azure AD B2C, users are now prompted to enroll in an MFA method during sign-up. Any sign-up user flows you created prior to general availability won't automatically reflect this new behavior, but you can include the behavior by creating new user flows

However you could decide based within userflow to use MFA during subsequent signin.

Thanks,

Akshay Kaushik

Share via

How to enable MFA (mobile authenticator) conditional access on a B2C client for select users while not requiring users without MFA to register an authenticator

Your answer