Why is "Remember MFA on trusted devices" not working in the Entra External Tenant ?

Question

I did the following things:

• A Microsoft Entra External Tenant was created.
• Two users were added to the tenant.
• Per-user MFA was enabled for one of the newly added users.
• The "Remember MFA on trusted devices" option was enabled, and the "Number of days the users can trust devices for" set to 2 days.
  
• An application was registered and integrated into an Angular frontend.

Despite the configuration, the user with MFA enabled is prompted for MFA at every login. The "Remember MFA" functionality does not appear to be working as expected.

Is there any configuration missing from my side ?

Answer 1

Hi, see:

https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-mfasettings

Answer 2

Hello Swaraj P P,

The "Remember multi-factor authentication on trusted devices" feature is supported in both Microsoft Entra External ID and Azure AD B2C tenants. To confirm this, I performed a quick test in my own External ID tenant by enabling the "Remember multi-factor authentication on trusted devices" option for 7 days using the Per-user MFA service settings. Please refer to the screenshot below.

After enabling this setting, all users in my tenant were able to see the option on the login screen to remember the device for the number of days specified.

I conducted the test using a regular user in the tenant—not a local or guest (B2B) account.

As Andy mentioned, it's important to note that this feature is not compatible with B2B users. The option will not appear for B2B users signing into invited tenants. In other words, if a user's identity is managed by an external identity provider rather than your own tenant, this feature will not be available. Reference: Remember multi-factor authentication – how the feature works.

To summarize:

• The feature is supported in both Entra External ID and Azure AD B2C tenants.
• It only works for users who are created in the same tenant.
• It does not work for B2B users signing into an external tenant.

I hope this information is helpful. Please feel free to reach out if you have any further questions. For a more detailed explanation with an example, please refer to the following Q&A post which discusses a similar scenario.

https://learn.microsoft.com/en-us/answers/questions/2265280/does-entra-external-tenant-support-trusted-device

Answer 3

Hello @Swaraj P P

Thank you for contacting Q&A Forum. Please check the following factors:

1. Sign-in logs: check if there are any Conditional Access policies with Session controls applied.
2. App: check if your app "Angular frontend" is using web to sign in users. The "Remember MFA on trusted devices" feature isn't working on non-browser applications.
3. Browser: check the user's browser settings to see cookies are being cleared after every closure.

Note that the remember multifactor authentication feature isn't compatible with B2B users and won't be visible for B2B users when they sign in to the invited tenants.

Kindly let me know if this work for you and please let me know if you have any further questions.

If I have answered your question, please accept this answer as a token of appreciation and don't forget to give a thumbs up for "Was it helpful"!

Best regards,

Megan.