DUO push is not prompting while login with Microsoft 365 email id(secured with DUO) from ASP.NET application

Question

I am successfully intergrated the DUO with Microsoft AD account, But i am facing some issues. When I am login on outlook with microsoft 365 email id it redirects to the DUO Push which is fine.

But when I am going to login with my web application (developed in Asp.net and login is integrated with Azure AD) with my microsoft 365 email id it is not going to DUO push or not asking any duo one time password my Application.

my web application selected as a protected Application in the Azure tenant where the Conditional Access Policies are set up.

can anyone send me some instructions because i did all settings in Azure AD and it is also working fine when login on microsoft outlook but it is not working when login with same email id on my application.

While login with my application (developed in Asp.net) with 365 email id it should redirect to DUO push after successfully login to Microsoft 365, because email id is secured with DUO which is also working fine when login on microsoft outlook.

Answer 1

Integrating DUO with Azure AD for multifactor authentication (MFA) and experiencing different behaviors in various applications, like Outlook and your ASP.NET web application, can be due to several reasons. The key here is to ensure that your web application's Azure AD integration and Conditional Access Policies are correctly configured to enforce DUO authentication. Here are some steps and considerations to troubleshoot and potentially resolve this issue:

1. Review Conditional Access Policies: Ensure that the Conditional Access Policies in Azure AD are correctly configured to require DUO MFA for your web application. Check if the policies are applied to all users or specific groups that include the users testing the application.
2. Application Registration and Configuration: Verify that your ASP.NET application is correctly registered in Azure AD and that the authentication settings are correctly pointing to Azure AD for identity management.
3. Conditional Access Policy Scope: Make sure that the Conditional Access Policies cover the application in question. Sometimes, policies are set up for specific applications like Microsoft 365 services but might not include custom applications by default.
4. DUO Configuration in Azure AD: Double-check the DUO integration settings within Azure AD. Ensure that DUO is set as a required step in the authentication process for the applications you wish to protect.
5. Testing with Different Users: Test the login process with different user accounts to ensure that it's not an issue isolated to a specific user account or group.
6. User Assignment to the Application: In Azure AD, ensure that the users or groups are correctly assigned to your ASP.NET application if you have any restrictions in place.
7. Session and Cookie Management: Investigate how your application manages sessions and cookies, as improper handling might bypass the redirect to DUO under certain circumstances.
8. Inspect Redirect URIs: During the authentication flow, inspect the redirect URIs to ensure that the flow is proceeding as expected and is attempting to redirect to DUO for MFA.
9. Check DUO Logs: Review the logs in your DUO admin panel to see if there are any attempted authentications from your ASP.NET application. This can give you insights into whether the requests are reaching DUO.
10. Check Application Code: In your ASP.NET application, ensure that the code handling Azure AD authentication is correctly implemented and does not bypass MFA requirements.
11. Consult Documentation and Support: Refer to both Azure AD and DUO documentation for guidance on integrating MFA with custom applications. If the issue persists, consider reaching out to Microsoft or DUO support for more tailored assistance.

Remember, the behavior of MFA like DUO can vary based on how applications are configured within Azure AD and how Conditional Access Policies are applied. Ensuring consistency across these settings is crucial for uniform MFA enforcement.

Accept the answer if the information helped you. This will help us and others in the community as well.