Login message says I must use MFA but SignUpSignInFlow says no MFA

Question

When I did an "az login" I received this message:

"error":"interaction_required","error_description":"AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '797f4846-ba00-4fd7-ba43-dac1f8f63013'.\r\nTrace ID: 348d5fb2-e91a-476d-b7e1-6d4d787d0400\r\nCorrelation ID: 700a81e3-75c9-47e0-aad5-94bfed299947\r\nTimestamp: 2020-04-16 18:04:46Z","error_codes":[50076],"timestamp":"2020-04-16 18:04:46Z","trace_id":"348d5fb2-e91a-476d-b7e1-6d4d787d0400","correlation_id":"700a81e3-75c9-47e0-aad5-94bfed299947","error_uri":"https://login.microsoftonline.com/error?code=50076","suberror":"basic_action"

However, when I go to my SignInSignUp flow, it shows MFA (multifactor Authentication) is disabled. What is going on? Do I have a problem or not?

Thanks
Siegfried

Answer 1

I just had a nice session with Brice from Azure support.

As part of a Microsoft AADB2C tutorial, I had created another azure directory/B2Ctenant. I was not aware that this process also created had created another user account. I don't know what this account is for -- I don't remember needing it for the AADB2C tutorial (so far). Deleting this new user account seems to have solved the problem (which was just an error message).

Thank you Brice

Siegfried

Answer 2

@Siegfried Heintze This is happening because Security Defaults is enabled for your tenant. You can disable it by navigating to Azure Portal > Azure AD > Properties > Click on Manage Security Defaults link > Toggle Enable Security Defaults button to NO.

Refer to https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults for more information about Security Defaults.

-----------------------------------------------------------------------------------------------------------

Please "Accept as answer" wherever the information provided helps you to help others in the community.

Answer 3

@Siegfried Heintze Security Defaults is a recent feature added for improving security by forcing all users in the tenant to register and perform MFA, without requiring any Azure AD Premium license. However, in some scenario like in case of dev/test tenants, you would not want to perform MFA during testing. In that case, you need to disable Security Defaults and if you have enabled MFA already, you would need to disable that as well. I have shared the steps to disable Security Defaults in my previous answer.

To disable MFA, you need to navigate to Azure Portal > Azure Active Directory > Users > Multi-Factor Authentication. This will redirect to Azure MFA Portal, where you can select users, you want to disable MFA for. Please refer to screenshot below:

-----------------------------------------------------------------------------------------------------------

Please "Accept as answer" wherever the information provided helps you to help others in the community.

Answer 4

@SiegfriedHeintze-9929 Could you please double check, if security defaults are Off by below option. Azure Portal > Azure AD > Properties > Click on Manage Security Defaults link > Toggle Enable Security Defaults button to NO.

Since it is a B2C tenant,

1. CA Policy or Azure AD Identity protection cannot trigger MFA.
2. You have confirmed SignUpSignInFlow flow is not configured with MFA.
3. On MFA Portal this option is set to Disable.
4. The only option left, that can trigger MFA is Security Defaults. Please check that and let me know if that is off and you are still getting MFA prompt.

Answer 5

Oh shucks... I posted a response and this web site lost it! Let me try again.

Good news: I followed your instructions and now I can login with no MFA!

Bad news: I'm still getting this less than friendly message from "az login". Can you explain to me what it means? Why does it say that I have been logged in but then I have failed to authenticate? Do we need to fix something? Perhaps it is related to the troubles I have been having that I have described in other posts (on Azure Functions)?

WARNING: You have logged in. Now let us find all the subscriptions to which you have access...

WARNING: Failed to authenticate '{'additional_properties': {}, 'id': '/tenants/1e694636-92fd-4ca7-b666-d0545514eb69', 'tenant_id': '1e694636-92fd-4ca7-b666-d0545514eb69'}' due to error 'Get Token request returned http error: 400 and server response: {"error":"interaction_required","error_description":"AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '797f4846-ba00-4fd7-ba43-dac1f8f63013'.\r\nTrace ID: 71ce1029-29bf-46ea-b900-479128c38e00\r\nCorrelation ID: 34da890e-8c4d-484f-868f-9eeade415ebe\r\nTimestamp: 2020-04-30 16:13:24Z","error_codes":[50076],"timestamp":"2020-04-30 16:13:24Z","trace_id":"71ce1029-29bf-46ea-b900-479128c38e00","correlation_id":"34da890e-8c4d-484f-868f-9eeade415ebe","error_uri":"https://login.microsoftonline.com/error?code=50076","suberror":"basic_action"}'

[

{

"cloudName": "AzureCloud",

"id": "acc26051-92a5-4ed1-a226-64a187bc27db",

"isDefault": true,

"name": "Azure subscription 1",

"state": "Enabled",

"tenantId": "7a838aec-0b9e-4856-a3b5-2b02613f36a2",

"user": {

  "name": "sheintze@hotmail.com",

  "type": "user"

}

}

]