Error message: AADSTS50079: Due to a configuration change made by your administrator, or because you moved to a new location, you must enroll in multi-factor authentication to access

Question

Hi, I am working for one of business owners and have some services setup on Azure.

The business owner created an account on Azure and then created a user with administration access and shared that user details with me.

I have been using the same user for my Azure Portal and it was working fine until today when I received this error,

Error code: AADSTS50079

Error message: AADSTS50079: Due to a configuration change made by your administrator, or because you moved to a new location, you must enroll in multi-factor authentication to access .....

I understand it is due to MFA but the problem is, I never activated MFA for my user and now since I can't log into the portal, I can't activate it. I have read on internet that the site admin (which would be the business owner in my case) will have to disable MFA by himself in such a scenario for me to regain my access. However, the issue is, he is not technical and it might be difficult to explain the same to him.

Is there any other possible solution to this so that I can log back into the portal?

Answer 1

There is a service account Microsoft creates for the sync called "sync_*Your-onprem-ServerNameHere*". The MFA requirement is applied to that service account, not the admin account you've logged into Entra Connect.

Someone else had the same issue and solved it in this thread: https://techcommunity.microsoft.com/discussions/azure-active-directory/azure-ad-connect-sync-account-mfa-support/689153

Answer 2

Hello Hassan Ashas_F1,

Thank you for posting in Microsoft Community forum.

From the description above, I understand your question is related to Azure.

Since there are no engineers dedicated to Azure in this forum. in order to be able to get a quick and effective handling of your issue, I recommend that you repost your question in the Q&A forum, where there will be a dedicated engineer to give you a professional and effective reply.

Here is the link for Q&A forum.
Questions - Microsoft Q&A

Click the "Ask a Question" button in the upper right corner to post your question and select "Azure" tag and any other tags related to your productions.

I hope the information above is helpful.

If you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

Answer 3

Hi Hassan,

It appears that Microsoft are currently running a campaign that switches on "security defaults" automatically. This is to force all users to setup MFA as this is far more secure.

In our case, we had an account that had no Multi-Factor Authentication methods setup, once security defaults turned on, it prompted us with the same error code: AADSTS50079

This may not be the most efficient method as I am not an expert, but this is what worked for us:

A user with Global Administrator permissions needs to do the following (In your case I will assume this is the Business Owner):

1. Visit https://entra.microsoft.com/ 
2. Click Identity > Overview > Properties
3. Under the 'Security Defaults' heading, click 'Manage security defaults'.
4. Change from 'Enabled' to 'Disabled'.
5. Now in the navigation pane, click Users > All Users > Click on the affected user
6. Click 'Authentication methods', enter a phone number to use with MFA.

This should now let you login, but for increased security I advise repeating step 2 and 3 to re-enable security defaults.

Answer 4

Additionally to the new MFA settings, we had to disable it via the old MFA setting https://account.activedirectory.windowsazure.com/UserManagement/MultifactorVerification.aspx

Answer 5

Thank you so much!