How to require all users of our application use 2fa/multifactor authentication when signing in through Azure

Question

We have a web application registered in Azure so users can sign in to our app using their Microsoft account via OIDC with the Microsoft auth server. The users sign in with a user name and password but we would like them to be required to use 2FA/MFA.

I see there is a 'conditional access' feature in the app registration but this appears to be more complicated than we need and only available in premium accounts/registrations. We would simply like to add the 2FA/MFA requirement to anyone logging into our app via Microsoft.

Is this possible?

Answer 1

Yes, it's possible to enforce multi-factor authentication (MFA) for users signing in to your Azure web application using their Microsoft accounts via OpenID Connect (OIDC). While Conditional Access offers granular control over access policies and requires premium licenses, there are simpler ways to enforce MFA for your application. You can achieve this by configuring the MFA settings directly within Azure Active Directory (Azure AD), without the need for Conditional Access. Here's a step-by-step guide:

1. Navigate to Azure Active Directory in the Azure portal: Go to the Azure portal (https://portal.azure.com) and select your Azure Active Directory.
2. Security settings: Navigate to the "Security" section of Azure Active Directory.
3. Conditional Access policies: You can create Conditional Access policies here, but as you mentioned, these are part of the premium features. Instead, for basic MFA enforcement, go to "Authentication methods" under the "Security" section.
4. Configure MFA: Under "Authentication methods", you can configure "Multi-Factor Authentication". Here, you can enforce MFA for all users, specific groups, or for Azure service management. Select the appropriate option for your application.
5. Select users/groups: Choose the users or groups for whom you want to enforce MFA. In your case, you might want to select all users accessing your web application.
6. Save settings: Once you've configured the MFA settings as per your requirements, save the changes.
   

By enforcing MFA at the Azure AD level, any user attempting to sign in to your web application with their Microsoft account will be prompted to complete the MFA process, thereby adding an extra layer of security to their authentication. Additionally, make sure that your application's authentication flow is configured to handle MFA challenges appropriately. This typically involves detecting MFA requirements during the authentication process and redirecting users to complete the MFA process if necessary. By following these steps, you can enforce MFA for users accessing your Azure web application via Microsoft accounts without the need for Conditional Access policies.

Answer 2

@B Mo If conditional access is not an option for you, you can explore security defaults feature - https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults Let me know if you have any further questions on the same, feel free to post back.