MFA not prompted after setting

Question

Good day!

I want to test a new policy that requires Multifactor authentication after login. Therefore, I created a new test user on Microsoft Entra ID.

After that, In Entra ID, I created a new policy by going to Security > Protect > Conditional Access > Create new policy. In the “Create new policy” menu, after setting the policy name, selecting the user, I looked for “Microsoft Azure Management” under Target Resource but could not find it. Therefore, I selected the resource “Azure ID Identity Governance” instead, and selected “Require Multifactor authentication” under Grant. However, after logging in with the test account, I wasn’t prompted to register the second factor of authentication. I repeated the test by selecting the resources “Azure Credential configuration endpoint service” and “Office 365” , and “Require multifactor authentication strength” inside Grant, but got the same results.

Then, under Microsoft Entra ID > Users, I found the option “Per-User MFA”, After clicking on “Per-user MFA”, selecting the correct user and clicking “Bulk update”, I was correctly prompted for Multifactor authentication after login.

therefore, I would like to ask the following:

• How can I configure multi factor authentication in the “Create new policy” menu? Especially, what shall I select under Target resource?
• How can I setup multifactor authentication using powershell?

Thanks for your support.

Answer 1

@Francis ,

The Conditional Access team also replied that you can apply the policy for the Microsoft Admin Portals instead. I'm still also waiting for confirmation about the name change though.

Cloud apps, actions, and authentication context in Conditional Access policy | Microsoft Learn

Answer 2

Hi @Francis ,

I checked in my tenant and am seeing the same issue, so I reached out to the Conditional Access team to see if they can confirm whether the name changed.

However, another engineer on my team has an older Conditional Access policy that he created for restricting access to Microsoft Azure Management. In that policy it looks like the cloud app referenced changed to Windows Azure Service Management API.

Additionally, when navigating to the Enterprise Applications list and searching for Windows Azure Service Management, this redirects to the Microsoft Azure Management app.

It looks like the name may have changed to Windows Azure Service Management API.

We are waiting on the Conditional Access team to confirm about this change and will update the thread once we hear back.

Answer 3

@Francis

Thank you for your post!

As mentioned by Marilee, I was able to reproduce your issue and wasn't able see the Microsoft Azure Management cloud app. However, I did notice that when I went to an older CA policy - one that I created specifically for restricting access to Microsoft Azure Management, the cloud app referenced changed to Windows Azure Service Management API.

Additionally, when navigating to the Enterprise Applications list and searching for Windows Azure Service Management, this redirected me to the Microsoft Azure Management app.

Once we hear back from the CA Policy team regarding this change, we'll update our documentation to help alleviate any future confusion for customers going forward.

---

Additional Links:

• Common Conditional Access policy: Require MFA for Azure management
• Conditional Access: Target resources
• Microsoft Azure Management not appearing in list of cloud apps - Related issue

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

---

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.