Facing an issue setting up MFA authentication for external guest users in an Azure - External Tenant
I am facing an issue setting up MFA authentication for external guest users in an Azure External Tenant. Here is the infrastructure setup I have configured in the external tenant:
- Created an application with supported account type (Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox))
- Created a group.
- Set up a Conditional Access (CA) policy with the following configurations:
- Under "Assignments," selected the group created in step 2.
- Selected the target resource, which is the application created in step 1.
- In "Access Control" -> "Grant" -> "Grant Access," I selected "Require multifactor authentication" and saved the policy.
- Made changes under Security settings:
- Navigated to "Security" -> "Authentication Methods" -> "Email OTP" and selected the group from step 2.
- Navigated to "Security" -> "Authentication Methods" -> "Email OTP" and selected the group from step 2.
- Invited guest users
- Added the invited guest users to the group created in step 2.
- Created a user flow under "External Identities" and linked it to the application created in step 1.
Problem:
When running the user flow for the first time, it prompts for the email and password, then sends an OTP to the email (for MFA - the screen appears as given in Image 1 below). After entering the code, the user is authenticated successfully. However, when rerunning the same user flow for the same user, after providing the username and password, I receive an OTP, enter it, and then get another OTP in a continuous loop(for MFA - the screen appears as given in Image 2 below).
This issue does not occur when using the same flow with a locally created account in the external tenant. Has anyone encountered this issue or found a solution? Any assistance would be appreciated.
Image 1:
Image 2: