Infinite Loop of Authentication when choosing required strength Passwordless MFA

Question

Hi all, I am currently trying to set up a Passwordless MFA sign in using the Microsoft Authenticator. I have a conditional policy with grant access as Require authentication strength set as Passwordless MFA.

I have an external react SPA application using msal-react to handle the login, registered with my tenant.

When I create an internal account in my tenant and try to login to my React application, I keep getting this infinite loop.

After keying in the password I got:

And clicking next goes to

Here I was expecting the set up for Microsoft Authenticator (which I did receive if I use the Require MFA option instead of the Require authentication strength but I don't want that as I want to force my user to use the Authenticator Passwordless sign in)

If I click mysecurityinfo and login I get

And the infinite cycles begin

Please advice!!!!!

Some more configuration:
Registration Campaign is disabled and security defaults are also disabled.

Answer 1

We also have the same problem. I tested various combinations and could identify that passwordless MFA is only working when the affected users are already enabled to use passwordless sign in.

This means they configured their MS Authenticator with this option:

When I applied the policy to a user that already had a functioning MS Authenticator connection but WITHOUT passwordless authentication enabled in MS Authenticator, the user gets stuck in the loop.

But when the user already enabled passwordless authentication in MS Authenticator, he could pass the authentication and login without getting stuck.

Although I also would have expected otherwise, Microsoft does not seem to cover migrating users who are not in passwordless mode yet to the passwordless state by a nice prompt during the auth flow when choosing passwordless MFA. Instead, the policy just requires all affected users to be passwordless already - otherwise they will get stuck in the loop.

Have you ever figured out how to cope with this issue? The insights I gained are practically making it impossible for us to use passwordless MFA since new users who need to setup their MS authenticator app for the first time during onboarding are not passwordless and would therefore always end up in the loop.

Answer 2

Hello

I think microsoft is trying to solve this issue by excluding the signup process only from the conditional access.

If you go to edit your conditional access policy you will see this;

Target resources > Select what this policy applies to > "Authentication context"

so somehow we have to find a way to exclude this authenticaiton context from the rest of the conditional access policy but there is no clear guide explaining how that should work,

can you figure that out?