Exclude Windows Hello for Business for SSO of Global Protect

Question

Dear PPL,

I have implemented Entra ID SSO and SAML for our organization VPN Portal login. Now some ppl complaining that Windows Hello for Business they set up on their devices somehow allow them to connect GP VPN without giving MFA....

I was wondering if there is a way we can enforce MFA for Windows Hello for Business from Conditional Access policy, or somehow exclude Windows Hello for Palo Global Protect Connections.

Thanks

Nameless

Answer 1

@Namless Shelter Apologies for the delayed response, to answer this statement - some ppl complaining that Windows Hello for Business they set up on their devices somehow allow them to connect GP VPN without giving MFA - Refer to this FAQ https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/faq#:~:text=Is%20Windows%20Hello%20for%20Business%20considered%20multifactor%20authentication%3F

Reference: https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/why-are-my-users-not-prompted-for-mfa-as-expected/ba-p/1449032

If the user is configured for WHFB, Entra ID honors the MFA claim from WH4B sign-in.

Hope this clarifies, if not you can review the sign in logs to understand whether MFA was not performed or not - https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-reporting

Let me know if you have any further questions, feel free to post back.