Switching my Active Directory to B2C Tenant in Azure Portal prompts for Approving Sign-In Request.

Question

I setup Azure B2C tenant in Azure Portal. At that time it must have prompted me to setup the account with Microsoft Authenticator which setup a different account in Authenticator with some "ext" text referring to external account to Azure B2C.

I do not have any MFA setup for my work account in my based Azure AD Tenant.
I accidentally deleted that account from my mobile phone. Now, I am locked out of my account.

I asked another guy in Azure B2C who had admin access to revoke MFA, and force registration of MFA, but it is not affecting my account. I even asked my based Azure AD admin to reset the MFA and revoke MFA in base tenant. But, switching directory still prompts for "Approve Sign in Request" screen mentioning that "We have sent the request to your mobile device. Please open Authenticator App to respond."

Is there any way to disable this MFA prompt.

I have observed that if i use my work account to login to other identity provider, it is asking for MFA even if it is not setup for your account.

Did anyone faced similar issue? How to overcome this issue?

Answer 1

Hello @Rizwan Ansari · Welcome to Q&A platform and thank you for your query.

The UPN in format user_fabrikam.com#EXT#@Company portal .onmicrosoft.com gets generated for guest users. If you have added the user of your Azure AD tenant as guest to your B2C tenant and while switching from your Azure AD tenant to the Azure AD B2C tenant, you are being prompted for MFA, it can be due to security defaults in the B2C tenant, as highlighted below:

To disable MFA prompt when switching from your primary Azure AD to B2C directory, disable "Security Defaults".

Read more: What are security defaults?

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.