Share via

Multiple identity providers/issuers

Jpan 106 Reputation points
2021-01-04T10:22:08.677+00:00

Hi,

I wanted to turn on MFA for a user, but saw that under the "Identity issuer" it says "Multiple", as opposed to our tenant name (which all of the other users have).
I tried going to authentication methods and deleting everything there, but the issue still persists. The second identity issuer is "phone"
I was able to turn on MFA for all users, except for this one.

What can I do, to make our tenant the only issuer/provider of the identity?

Thanks

Microsoft Security | Microsoft Entra | Microsoft Entra ID
Accepted answer
  1. Jpan 106 Reputation points
    2021-01-05T10:36:49.783+00:00

    Ok, I managed to solve this.
    Even though the phone number was deleted, it was still showing Phone as an identity issuer. I added a dummy phone number and deleted it again, and now it's OK.

    1 person found this answer helpful.

3 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. soumi-MSFT 11,831 Reputation points Microsoft Employee Moderator
    2021-01-04T13:13:08.48+00:00

    Hello @Jpan , thank you for reaching out. Identity Issuer with a value of Multiple states that the user has multiple issuers. You can get the details of the issuers (Identity Issuer) as well as a few other information like Sign-In Type and the Issuer Assigned ID once you click on that "Multiple" hyperlink under the Identity Issuer column.

    53331-multipleissuer.png

    For the screenshot above you would find the user is a guest user and originally belong to Gmail. In such cases like if the user belongs to some other AAD Tenant or to some other IDP all total (Guest Users/B2B users), you cannot enable Azure MFA by choosing the per-user MFA option found on top of the AAD-Users portal.
    53197-mfa-peruser.png

    For Guest users/B2B Users, you can enable MFA using Conditional Access Policy. You can refer to the following link to enable Conditional Access Policy for GuestUsers/B2B Users: https://learn.microsoft.com/en-us/azure/active-directory/external-identities/b2b-tutorial-require-mfa#:~:text=On%20the%20Cloud%20apps%20page%2C%20select%20Done.,Under%20Enable%20policy%2C%20select%20On.

    Hope this helps.

    Do let us know if this helps and if there are any more queries around this, please do let us know so that we can help you further. Also, please do not forget to accept the response as an Answer; if the above response helped in answering your query.

    0 comments
  2. Jpan 106 Reputation points
    2021-01-04T15:31:26.317+00:00

    Hi,

    I clicked on the "Multiple" and saw that the Phone is set as an Identity Issuer (type federated).
    I'm trying to remove this option, but I can't seem to find a way to do so. How can I remove the phone as an identity issuer?

    The account that is created has our domain and everything, it's not an "outside" account.

  3. Christopher Bishop 0 Reputation points
    2023-05-22T11:10:25.45+00:00

    Hi

    I fixed this issue by going to the authentication methods for the user and clicking the "Disable SMS Sign-in" and took a few minutes but reverted the user back to the Tenant identity (removing the phone federation).

    I am not not but it might be related the the MFA authentication methods that are configured

    User's image

    Therefore I am disabling this option for now, as we require password authentication

    User's image

    User's image

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.