Facing an issue setting up MFA authentication for external guest users in an Azure - External Tenant

Nathiya Palaniyappan 5 Reputation points
2024-10-03T13:41:25.3833333+00:00

I am facing an issue setting up MFA authentication for external guest users in an Azure External Tenant. Here is the infrastructure setup I have configured in the external tenant:

  1. Created an application with supported account type (Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox))
  2. Created a group.
  3. Set up a Conditional Access (CA) policy with the following configurations:
    • Under "Assignments," selected the group created in step 2.
    • Selected the target resource, which is the application created in step 1.
    • In "Access Control" -> "Grant" -> "Grant Access," I selected "Require multifactor authentication" and saved the policy.
  4. Made changes under Security settings:
    • Navigated to "Security" -> "Authentication Methods" -> "Email OTP" and selected the group from step 2. Email OTP
  5. Invited guest users

Guest_User

  1. Added the invited guest users to the group created in step 2.
  2. Created a user flow under "External Identities" and linked it to the application created in step 1.

userflow

Problem:

When running the user flow for the first time, it prompts for the email and password, then sends an OTP to the email (for MFA - the screen appears as given in Image 1 below). After entering the code, the user is authenticated successfully. However, when rerunning the same user flow for the same user, after providing the username and password, I receive an OTP, enter it, and then get another OTP in a continuous loop(for MFA - the screen appears as given in Image 2 below).

This issue does not occur when using the same flow with a locally created account in the external tenant. Has anyone encountered this issue or found a solution? Any assistance would be appreciated.

Image 1:

MFA_OTP1

Image 2:

Email OTP 2

Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
3,148 questions
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.