Prevent constant MFA requests for hybrid workforce

Chad Brosseau 0

Hello,

Most of our users are hybrid, working remotely via VPN and locally in office. Regardless of our 30-day MFA policy, our users are prompted for MFA every few days if they move locations between working at home and at the office.

We are a non-profit healthcare organization of 600 staff, using primarily Office E3 & Azure P1, Exchange in the cloud, and local AD sync. I cannot for the life of me determine what policies I need to adjust to get consistent results from MFA. 30 days should be 30 days. Employee devices are laptops with domain accounts- nothing is being wiped or reset.

If there is some special Conditional Access magic that I am missing, I am all ears- but the current state of this is unsustainable.

Thank you,

LiweiTian-MSFT 14,615 Reputation points Microsoft Vendor

2024-04-29T07:24:35.57+00:00

Hi,

Teams tag is mainly focused on the general issue of Microsoft Teams troubleshooting. According to your description, your question is not in our support scope. So, we will remove teams tag from your thread. Thanks for your understanding and patience!

2 answers

Andy David - MVP 142.2K Reputation points MVP

2024-04-24T16:25:14.19+00:00

Wonder if CAE is involved with the change in IP address when a user moves location:

https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-continuous-access-evaluation

https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-session#customize-continuous-access-evaluation
Please sign in to rate this answer.
Chad Brosseau 0 Reputation points

2024-04-25T13:19:04.5366667+00:00

Thank you! I think this is a good direction- somewhat of a rabbit hole for my network admin to configure... however, looking at the token lifetime defaults when not using Conditional Access for token policy, Microsoft has allowed 90 days for refresh tokens, and "until revoked" for MFA session tokens. It does mention that "non-persistent session tokens have a Max Inactive Time of 24 hours" which may have some implications here. I feel there must be a simpler way to troubleshoot and adjust this- I can't imagine we are the only agency experiencing it.
Sign in to comment
Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,246 Reputation points

2024-04-25T07:36:46.61+00:00

Use the Microsoft Entra sign-ins report. This report shows authentication details for events when a user is prompted for multifactor authentication, and if any Conditional Access policies were in use: https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-reporting#view-the-microsoft-entra-sign-ins-report
Please sign in to rate this answer.
Chad Brosseau 0 Reputation points

2024-04-25T13:33:57.94+00:00

Thanks Alfredo, but I am familiar with the sign-ins report. I can always see when there is MFA called and a primary refresh token issued, but it does nothing to allude to why it was prompted or reasoning behind its periodicity.

Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,246 Reputation points

2024-04-25T15:08:39.1966667+00:00

So it's not CA. Can you detail your VPN/network setup/authentication flow? What, how, where, when?

Chad Brosseau 0 Reputation points

2024-04-29T12:19:47.2866667+00:00

Sure, VPN provided by a mix of AnyConnect and CMAK profiles, local LAN via VPN meshed Cisco Meraki between sites. MFA environment is through Azure, which is set to 30 days at the moment. Staff use VPN when at home, and use a local secure VLAN when at the office. Authentication works, but it seems when we change both of 1. IP (when moving home from office) AND 2. switching off and on VPN, the MFA prompts happen every few days.
Sign in to comment