Can anyone tell me how to configure Azure (B2C) SUSI / MFA to use both Auth App and Email please?

Question

Hi All, HELP PLEASE!!!

TAGS: AzureB2C \ User Flows \ SUSI policy \ MFA \ Conditional Access \ MS Authenticator App \ Email Auth
(because tags above don't work)

We have external customers logging into our SaaS Application through AADB2C we are using combined SUSI, but for some crazy unknown reason Microsoft will only allow you to select ONE Authentication Method. In this day and age, who on earth wants to restrict all their users to one single Authentication Method.

Some want MS Auth App others want Email.

Someone please tell me why you cannot select one/more option for MFA, after all it's called Multi factor Authentication for some reason. Microsoft??? anyone there know why or how to circumvent this restrictive control please. Documentation is shockingly bad compared to the old TechNet days.

Any help or advice in how to do this please, any suggestions welcome, as this like most things is now under time pressure.

TIA.. John.

Answer 1

The situation you're describing with Azure AD B2C (Azure Active Directory B2C) and the limitation to one authentication method for multi-factor authentication (MFA) in a combined Sign-Up/Sign-In (SUSI) flow is a common concern. Let's address this and explore potential solutions:

Understanding the Limitation

• Default Behavior: Azure AD B2C, by default, allows the configuration of a single method for MFA during the SUSI process. This limitation is often in place to streamline the user experience and maintain security standards.
• User Preferences: However, this can be restrictive for scenarios where different users prefer different authentication methods (e.g., Microsoft Authenticator App vs. Email).

Potential Solutions and Workarounds

1. Custom Policies (Identity Experience Framework):
   • Azure AD B2C's custom policies (also known as the Identity Experience Framework) offer more flexibility and can be tailored to provide multiple MFA options.
   • You can design a user journey that allows the user to choose their preferred MFA method during signup or login.
   • The complexity is higher, and it requires an understanding of custom policy configurations. Refer to the Azure AD B2C Custom Policy documentation for guidance.
2. Conditional Access:
   • If your Azure AD B2C tenant is linked with Azure AD Premium, you might leverage Conditional Access policies to define more granular controls and MFA requirements based on certain conditions (like user roles, locations, etc.).
3. User Interface Customization:
   • Customize the user interface of your SUSI flow to present options for MFA. This requires custom development work on top of the Azure AD B2C platform.
4. Feedback to Microsoft:
   • Given that product enhancements often stem from user feedback, consider providing this feedback directly to Microsoft through Azure feedback forums.

Additional Considerations

• Testing and Validation: Any custom implementation should be thoroughly tested, especially concerning security and user experience.
• Documentation and Community Support: While you've noted the lack of comprehensive documentation compared to TechNet, the Azure AD B2C documentation is continually updated. Additionally, consider reaching out to the Azure community forums for insights and shared experiences.

Conclusion

While Azure AD B2C's standard configurations might seem limiting regarding MFA methods in the SUSI flow, exploring custom policies or other advanced features can provide the flexibility you need. It's important to balance this customization with considerations for security, user experience, and maintainability.

Accept the answer if the information helped you. This will help us and others in the community as well.