Required MFA

Question

Microsoft has announced that it will mandate Multi-Factor Authentication (MFA) for all Azure users. Given that our organization has transitioned to Cisco Duo as our primary MFA solution, I am seeking clarification on how this policy will integrate with third-party MFA providers like Duo. Specifically, will there be support or compatibility for integrating Cisco Duo with Microsoft’s MFA requirements?

To provide some context, our decision to switch to Cisco Duo was driven by several key technical considerations. Cisco Duo offers a robust, unified platform for managing MFA across various applications and services, which simplifies our security posture and reduces administrative overhead. Additionally, Duo’s extensive integration capabilities with a wide range of applications and its user-friendly interface align well with our security and operational requirements.

Understanding how Microsoft plans to accommodate third-party MFA solutions will be crucial for our compliance strategy and ensuring a seamless transition for our users.

Answer 1

As quoted from the documentation: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication#external-authentication-methods-and-identity-providers

Support for external MFA solutions is in preview with external authentication methods, and can be used to meet the MFA requirement. The legacy Conditional Access custom controls preview won't satisfy the MFA requirement. You should migrate to the external authentication methods preview to use an external solution with Microsoft Entra ID.  If you're using a federated Identity Provider (IdP), such as Active Directory Federation Services, and your MFA provider is integrated directly with this federated IdP, the federated IdP must be configured to send an MFA claim.

In other words, Microsoft does not care how MFA was performed, as long as the relevant claims are present in the access token. If you have already configured Duo or another third-party provider, you can easily confirm this is the case by decoding the access token via jwt.ms or similar tools.