How to get token if MFA is enabled( we need to automate this)

Question

1. how do we get OAuth\JWT token when MFA is enabled , as per the policy in our company, our test account cannot be disabled for MFA

Answer 1

Hi @Pramuk, K.C. (SGRE COG DVL SW) · Thank you for reaching out.

When MFA is enabled for a user account, you are required to prove:

1. Who you are (using username/password) - Can be automated
2. What you own (Mobile/AuthenticatorApp/Haredware token) - Can NOT be automated as it requires manual input.

If you are looking for automating the authentication without disabling MFA for the account, you can:

• Exclude public IP address/Subnet that represents the computer(s) where you want to automate authentication for this accout.
• Use Azure AD Joined/Hybrid Joined/Registered devices, where you need to perform MFA once and MFA information will get stored in PRT, user won't be prompted for MFA afterwards.

If you are using this account for script automation:

• Use application context by using client_credentials flow for authentication.
• Or if you are running the script on Azure VM, consider using Managed Identity for authentication.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

MFA authentication can be:

1. What user know, like a password
2. What the user has..."a certificate". Could it work for you?
   The validation of a certificate can be automated.