25,081 questions
How can I activate Multi-Factor Authentication (MFA) for a multi-tenant identity provider?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(76.8, 94%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESR%3C/text%3E%3C/svg%3E)
Satish Rabari
0
Reputation points
I am utilizing a custom policy for sign-in with a multi-tenant Identity provider, and I've enabled the MFA TOTP method. However, I'm encountering the following error:
Error: The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.
Correlation ID: 84e393de-e2e4-46dc-a3cc-89feb10e3ba6
Timestamp: 2023-10-09 09:25:23Z
UserMessageIfServerError: An exception has occurred.
Could you please provide assistance in resolving this issue?
Here is the custom policy files
TrustFrameworkExtensions.xml
SignUpOrSignin.xm
Microsoft Security Microsoft Entra Microsoft Entra ID
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(246.4, 20%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESM%3C/text%3E%3C/svg%3E)
Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator2023-10-10T12:26:38.4333333+00:00 Thanks for reaching out.
Based on the extension policy you provided, it appears that Microsoft Entra Single Tenant Identity Provider has been set up.
You can set up Multi-Factor Authentication (MFA) using Time-based One-Time Passwords (TOTP) in a manner similar to any other Identity Provider.
To enable MFA for your Identity Provider, simply include MFA in your user journey.
Please attempt to configure Azure AD (Multi-tenant) IDP once more, ensuring that you provide the correct URLs so that the request can be executed successfully.
Thanks,
Shweta
-
Satish Rabari 0 Reputation points
2023-10-10T15:32:57.19+00:00 @Shweta Mathur
Thank you for your response.
I've outlined my user journey for the sign-in process. Could you please guide me on where I should incorporate the Multi-Factor Authentication (MFA) step into this journey?<UserJourney Id="CustomSignUpOrSignIn"> <OrchestrationSteps> <OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin"> <ClaimsProviderSelections> <ClaimsProviderSelection TargetClaimsExchangeId="AzureADCommonExchange" /> </ClaimsProviderSelections> <ClaimsExchanges></ClaimsExchanges> </OrchestrationStep> <!-- Check if the user has selected to sign in using one of the social providers --> <OrchestrationStep Order="2" Type="ClaimsExchange"> <Preconditions> <Precondition Type="ClaimsExist" ExecuteActionsIf="true"> <Value>objectId</Value> <Action>SkipThisOrchestrationStep</Action> </Precondition> </Preconditions> <ClaimsExchanges> <ClaimsExchange Id="AzureADCommonExchange" TechnicalProfileReferenceId="AADCommon-OpenIdConnect" /> </ClaimsExchanges> </OrchestrationStep> <!-- For social IDP authentication, attempt to find the user account in the directory. --> <OrchestrationStep Order="3" Type="ClaimsExchange"> <Preconditions> <Precondition Type="ClaimEquals" ExecuteActionsIf="true"> <Value>authenticationSource</Value> <Value>localAccountAuthentication</Value> <Action>SkipThisOrchestrationStep</Action> </Precondition> </Preconditions> <ClaimsExchanges> <ClaimsExchange Id="AADUserReadUsingAlternativeSecurityId" TechnicalProfileReferenceId="AAD-UserReadUsingAlternativeSecurityId-NoError" /> </ClaimsExchanges> </OrchestrationStep> <!-- Show self-asserted page only if the directory does not have the user account already (i.e. we do not have an objectId). This can only happen when authentication happened using a social IDP. If local account was created or authentication done using ESTS in step 2, then an user account must exist in the directory by this time. --> <OrchestrationStep Order="4" Type="ClaimsExchange"> <Preconditions> <Precondition Type="ClaimsExist" ExecuteActionsIf="true"> <Value>objectId</Value> <Action>SkipThisOrchestrationStep</Action> </Precondition> </Preconditions> <ClaimsExchanges> <ClaimsExchange Id="SelfAsserted-Social" TechnicalProfileReferenceId="SelfAsserted-Social" /> </ClaimsExchanges> </OrchestrationStep> <!-- This step reads any user attributes that we may not have received when authenticating using ESTS so they can be sent in the token. --> <OrchestrationStep Order="5" Type="ClaimsExchange"> <Preconditions> <Precondition Type="ClaimEquals" ExecuteActionsIf="true"> <Value>authenticationSource</Value> <Value>socialIdpAuthentication</Value> <Action>SkipThisOrchestrationStep</Action> </Precondition> </Preconditions> <ClaimsExchanges> <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" /> </ClaimsExchanges> </OrchestrationStep> <!-- The previous step (SelfAsserted-Social) could have been skipped if there were no attributes to collect from the user. So, in that case, create the user in the directory if one does not already exist (verified using objectId which would be set from the last step if account was created in the directory. --> <!-- <OrchestrationStep Order="6" Type="ClaimsExchange"><Preconditions><Precondition Type="ClaimsExist" ExecuteActionsIf="true"><Value>objectId</Value><Action>SkipThisOrchestrationStep</Action></Precondition></Preconditions><ClaimsExchanges><ClaimsExchange Id="AADUserWrite" TechnicalProfileReferenceId="AAD-UserWriteUsingAlternativeSecurityId" /></ClaimsExchanges></OrchestrationStep> --> <OrchestrationStep Order="6" Type="InvokeSubJourney"> <JourneyList> <Candidate SubJourneyReferenceId="TotpFactor-Input" /> </JourneyList> </OrchestrationStep> <!-- Call the TOTP validation sub journey--> <OrchestrationStep Order="7" Type="InvokeSubJourney"> <JourneyList> <Candidate SubJourneyReferenceId="TotpFactor-Verify" /> </JourneyList> </OrchestrationStep> <OrchestrationStep Order="8" Type="ClaimsExchange"> <ClaimsExchanges> <ClaimsExchange Id="RESTGetProfile" TechnicalProfileReferenceId="REST-GetProfile" /> </ClaimsExchanges> </OrchestrationStep> <OrchestrationStep Order="9" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" /> </OrchestrationSteps> <ClientDefinition ReferenceId="DefaultWeb" /> </UserJourney>
Sign in to comment
Sign in to answer