This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(278.4, 8%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETD%3C/text%3E%3C/svg%3E)
Tags like MFA, PIM and Conditional Access don't exist so I can't add those up there.
We have setup PIM in our environment and setup a Conditional Access Policy to force an MFA prompt with every activation. However, Edge will do it but Chrome will not. Below are screenshots.
Chrome: it doesn't even get to the point where it recognizes that the policy applies to the person:
But with Edge, it does recognize the resource (as not configured) and it prompts properly:
How do I get Chrome to work? What is "Resource"? because I don't see it.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(166.4, 27%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERP%3C/text%3E%3C/svg%3E)
Hello @Thomas Deliduka,
Thank you for posting your query on Microsoft Q&A.
Based on your description, I understand that you have created a conditional access policy with an authentication context to require MFA (every time) when a user attempts to activate a role. However, you’ve observed that MFA is only being prompted in the Edge browser, but not in Chrome.
From the screenshots you provided, I see that in the first screenshot, it shows that the PIM CA policy is not applied to the Azure Portal resource, which is expected. The reason this is expected is that the sign-in event you're referring to occurred when the user logged into the Azure Portal, not when activating PIM. As a result, the policy is showing as "Not Applied" because it wasn't triggered by the PIM activation.
The second screenshot you referenced appears when the PIM is being activated and the MFA prompt is completed.
To further investigate the issue and understand the behavior you're encountering, a deeper look is required. Please feel free to send me an email at AzCommunity@microsoft.com with the subject "Attn: Pothurajur" and include the following details in the body: the link to this thread/post.
We can connect offline and discuss this in more detail.
Thanks,
Raja Pothuraju.
What does your CA policy look like specifically? You typically set MFA activation within the settings of the PIM role, not with a CA policy ( and the CA policy is to set an auth context strength)
Yes, we followed that page, and we setup the CA and set the context. According to this paragraph: If your goal is to ensure that users must provide authentication during activation, you can use On activation, require Microsoft Entra Conditional Access authentication context together with Authentication Strengths. These options require users to authenticate during activation by using methods different from the one they used to sign in to the machine.
We have the group as our PIM admins, we have no other conditions so that should just work for everything.
I don't think the session sign in frequency requirement makes sense here.
Per the article:
If you want the PIM group to MFA each time they access Azure, I would create a different CA policy and enforce session requiriements there.
You quoted me the same paragraph I quoted to you. We don't want them to MFA each time they access Azure. We want MFA each time they activate PIM. Our research seems to indicate this is a new feature. and it works just fine in Edge, just not in Chrome.
This is where we found the sign in frequency. The use case in the article is for PIM Activation: https://techcommunity.microsoft.com/blog/identity/prompt-users-for-reauthentication-on-sensitive-apps-and-high-risk-actions-with-c/4062703
I assume in incognito mode with Chrome it does prompt each time? I havent tested that with a session time out added in there. I typically separate session timeouts from any other requirement.
No, Same thing happens in incognito mode.
Let me see if I can reproduce.
Well, after the weekend, it started just working as it should. At least from what I can tell.