Login message says I must use MFA but SignUpSignInFlow says no MFA

Siegfried Heintze 1,861 Reputation points
2020-04-16T18:31:15.373+00:00

When I did an "az login" I received this message:

"error":"interaction_required","error_description":"AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '797f4846-ba00-4fd7-ba43-dac1f8f63013'.\r\nTrace ID: 348d5fb2-e91a-476d-b7e1-6d4d787d0400\r\nCorrelation ID: 700a81e3-75c9-47e0-aad5-94bfed299947\r\nTimestamp: 2020-04-16 18:04:46Z","error_codes":[50076],"timestamp":"2020-04-16 18:04:46Z","trace_id":"348d5fb2-e91a-476d-b7e1-6d4d787d0400","correlation_id":"700a81e3-75c9-47e0-aad5-94bfed299947","error_uri":"https://login.microsoftonline.com/error?code=50076","suberror":"basic_action"

However, when I go to my SignInSignUp flow, it shows MFA (multifactor Authentication) is disabled. What is going on? Do I have a problem or not?

Thanks
Siegfried

Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
2,652 questions
Accepted answer
  1. Siegfried Heintze 1,861 Reputation points
    2020-05-05T23:22:14.56+00:00

    I just had a nice session with Brice from Azure support.

    As part of a Microsoft AADB2C tutorial, I had created another azure directory/B2Ctenant. I was not aware that this process also created had created another user account. I don't know what this account is for -- I don't remember needing it for the AADB2C tutorial (so far). Deleting this new user account seems to have solved the problem (which was just an error message).

    Thank you Brice

    Siegfried

    0 comments

7 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. AmanpreetSingh-MSFT 56,311 Reputation points
    2020-05-04T06:34:09.16+00:00

    @Siegfried Heintze , I tracked the error based on the correlation ID that you shared and found that Security Defaults applied to Azure CLI.

    Since you have disabled Security Defaults, I would suggest you to close any existing PowerShell/Azure CLI sessions, where you are trying az login and start a new session. Looks like the change will take effect on new session.

    -----------------------------------------------------------------------------------------------------------

    Please do not forget to "Accept the answer" wherever the information provided helps you to help others in the community.

    0 comments
  2. Siegfried Heintze 1,861 Reputation points
    2020-05-04T16:35:32.37+00:00

    OK, I have taken your advice and I have logged out ("az logout") a second time to confirm that I am logged out.

    I now do "az login" again and get a very similar message. While it does not seem to be causing any problem, I'm hesitant to ignore it without understanding it better. 

    WARNING: You have logged in. Now let us find all the subscriptions to which you have access...

    WARNING: Failed to authenticate '{'additional_properties': {}, 'id': '/tenants/1e694636-92fd-4ca7-b666-d0545514eb69', 'tenant_id': '1e694636-92fd-4ca7-b666-d0545514eb69'}' due to error 'Get Token request returned http error: 400 and server response: {"error":"interaction_required","error_description":"AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '797f4846-ba00-4fd7-ba43-dac1f8f63013'.\r\nTrace ID: e1cc0115-d02f-4446-ac27-cc6b71376400\r\nCorrelation ID: 5d598d3c-c264-47bf-9154-f13d1a42f4c5\r\nTimestamp: 2020-05-04 16:23:21Z","error_codes":[50076],"timestamp":"2020-05-04 16:23:21Z","trace_id":"e1cc0115-d02f-4446-ac27-cc6b71376400","correlation_id":"5d598d3c-c264-47bf-9154-f13d1a42f4c5","error_uri":"https://login.microsoftonline.com/error?code=50076","suberror":"basic_action"}'

    [

    { 

    "cloudName": "AzureCloud",

"id": "acc26051-92a5-4ed1-a226-64a187bc27db",

"isDefault": true,

"name": "Azure subscription 1",

"state": "Enabled",

"tenantId": "7a838aec-0b9e-4856-a3b5-2b02613f36a2",

"user": {

  "name": "sheintze@hotmail.com",

  "type": "user"

}

    }

    ]

  3. PtwHub 1 Reputation point
    2020-09-07T18:03:58.867+00:00

    In my case this happened because in my current browser, I had selected a different Azure Directory (Tenant) that the one I was trying to access with the CloudShell. So the /devicelogin was using the code to try and access the AD selected in the browser and not the one I had selected in the CloudShell => Easiest solution: just logout of your browser session and start a new one to do the /devicelogin

    0 comments