This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(3.2, 46%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESS%3C/text%3E%3C/svg%3E)
I am using a Conditional Access policy with the purpose of getting a two-factor authentication prompt when enabling an eligible role in PIM. The CA policy I am using has the authentication strength 'phishing-resistant MFA' option. Still, the prompt doesn't show if I am already logged in to Azure using a FIDO2 security key. However, the prompt does show if my first login to Azure was made using a different 2FA method like the Authenticator app. Then, upon activating the role, a prompt shows as wanted, saying that a Conditional Access policy applies here, and I can only continue to activate my role if I sign in using a security key. What could be the cause of this behavior?
Note: When the authentication strength 'Passwordless MFA' is chosen in the CA Policy, for users that don't use FIDO2 Keys, this works every time. Meaning when a user logs in to Azure Portal with 2FA (Authenticator app) and then proceeds to PIM to try to activate a role, this user is prompted every time to provide 2FA login again. Using FIDO2 with the 'Passwordless' authentication strength sadly doesn't trigger anything.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 17%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGM%3C/text%3E%3C/svg%3E)
@Said Samir Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?
If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.
If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
Still having the same problem..
The whole thing works perfectly when FIDO2 is not required, meaning logging into Azure with the Auth app as the 2FA method, then going to PIM to activate a prompt shows up that a CA applies here, and then you can click continue where you are forwarded to a login screen where 2FA can be confirmed by FIDO2 key or Auth app. THIS WORKS EVERY TIME.
The problem is not all users in my environment have a work phone, and the replacement is FIDO2 keys.
So, with my setup, when a user logs into Azure with a FIDO2 key as their 2FA, then goes to PIM to activate a role, the prompt that I described before doesn't show.
Since my test user has both FIDO2 key and Auth app, when I log in to Azure and avoid using the FIDO2 key as my 2FA and use the Auth app instead, then it's all fine again, and when activating a role, I am asked for 2FA again.
That sounds expected. If you have already authenticated with a FIDO key, then you have met the requirement.
Not really. The whole thing works perfectly when FIDO2 is not required, meaning logging into Azure with the Auth app as the 2FA method, then going to PIM to activate a prompt shows up that a CA applies here, and then you can click continue where you are forwarded to a login screen where 2FA can be confirmed by FIDO2 key or Auth app. THIS WORKS EVERY TIME.
The problem is not all users in my environment have a work phone, and the replacement is FIDO2 keys.
So, with my setup, when a user logs into Azure with a FIDO2 key as their 2FA, then goes to PIM to activate a role, the prompt that I described before doesn't show.
Since my test user has both FIDO2 key and Auth app, when I log in to Azure and avoid using the FIDO2 key as my 2FA and use the Auth app instead, then it's all fine again, and when activating a role, I am asked for 2FA again.
Sorry for the long answer; it's kinda weird and hard to describe shortly.