Many prompts for Approval from Microsoft Authenticator app with MFA

Question

Many prompts for Approval from Microsoft Authenticator app with MFA

thas 101

Hi All,
We use Azure MFA for users to remote in to their desktops through Remote Desktop Gateway. I have one user that gets prompted multiple times by the Microsoft Authenticator app - after she has disconnected. I can see in the Activity Report that on June 12 she logged in through the Remote Desktop Gateway at about 10:00am and was prompted once. She then disconnected at about 12:45pm that same day and was then prompted 22 times in about a 30 minute period to approve the login.

This was not the only time this has heppend to her, it is just one example. I have not heard about anyone else having this issue.

Can anyone tell me why this happens to her? Any way to fix this issue?

Thanks!

JamesTran-MSFT 27,506 Reputation points Microsoft Employee

2021-07-01T21:22:48.78+00:00
@thas
Thank you for the detailed post!

Because this is happening to only one user, how're they disconnecting from the VM?

Are there any background apps that could be trying to login the user? Or request for authentication?

Is this happening on a daily basis or is this only every once in a while?

Does it only happen when the user logs out or does it still happen when they shut down their machine?

This is definitely an interesting issue, and I believe our support team should take a closer look into your environment in order to troubleshoot this.

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
thas 101 Reputation points

2021-07-02T13:53:53.42+00:00
Hello James,

She is closing the RDP session using the X in the control bar at the top of the screen.

Neither of us are aware of any apps that are trying to log in. I would think that this would happen at other times as well if it was an app. It only happens when she disconnects.

It only happens when she disconnects from the RDP session that was logged in through RDG using Azure MFA.

It only happens when disconnecting. Shutting down does not trigger it.

I will go through the Support Team if nothing here points me to a resolution.

Thank you!

JamesTran-MSFT 27,506 Reputation points Microsoft Employee

2021-07-01T21:22:48.78+00:00

@thas
Thank you for the detailed post!

Because this is happening to only one user, how're they disconnecting from the VM?

Are there any background apps that could be trying to login the user? Or request for authentication?

Is this happening on a daily basis or is this only every once in a while?

Does it only happen when the user logs out or does it still happen when they shut down their machine?

This is definitely an interesting issue, and I believe our support team should take a closer look into your environment in order to troubleshoot this.

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
thas 101 Reputation points

2021-07-02T13:53:53.42+00:00

Hello James,

She is closing the RDP session using the X in the control bar at the top of the screen.

Neither of us are aware of any apps that are trying to log in. I would think that this would happen at other times as well if it was an app. It only happens when she disconnects.

It only happens when she disconnects from the RDP session that was logged in through RDG using Azure MFA.

It only happens when disconnecting. Shutting down does not trigger it.

I will go through the Support Team if nothing here points me to a resolution.

Thank you!

Answer 1

We now have a resolution on this. It turned out that when she was done working, she would just close the lid on her laptop without disconnecting the session first. I told her to try disconnecting first using the "X" the next time she connected. She did so last night and was not prompted again after disconnecting. I verified that the logs did not show the repeated attempts to reconnect.

Thank you for your suggestions!

Answer 2

Andy YOU 2,941

HI thaslett-2964,

1.What's authentication methods do you use?

If we change the authentication method to notification in mobile phone, will the same issue happen?

Authentication methods in Azure Active Directory - Microsoft Authenticator app
https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-authenticator-app

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

thas 101 Reputation points

2021-07-02T14:00:17.103+00:00

Hello Jia,
We already use the Microsoft Authenticator app notifications. We set all of our MFA users up to use this, so we have several people using it without this issue, including myself. That is the prompt that I was referring to by the app.
Andy YOU 2,941 Reputation points

2021-07-06T09:19:58.83+00:00

HI thaslett-2964,

I find below thread about your issue.

"A user might see multiple MFA prompts on a device that doesn't have an identity in Azure AD. Multiple prompts result when each application has its own OAuth Refresh Token that isn't shared with other client apps. In this scenario, MFA prompts multiple times as each application requests an OAuth Refresh Token to be validated with MFA."

Optimize reauthentication prompts and understand session lifetime for Azure AD Multi-Factor Authentication
https://learn.microsoft.com/en-us/azure/active-directory/authentication/concepts-azure-multi-factor-authentication-prompts-session-lifetime
thas 101 Reputation points

2021-07-07T16:55:14.167+00:00

Thanks for bringing that to my attention, but her PC is registered in Azure AD. Also, I would think that it would be a regular thing to get prompted in that scenario, not exclusively after disconnecting from an RDG session.
Andy YOU 2,941 Reputation points

2021-07-12T03:58:26.99+00:00

HI

"This was not the only time this has heppend to her, it is just one example."
1.How often this issue happen? Is current issue a random issue?
2.Is there other user have the same issue?
3.What's the difference setting between normal user and issue user?
4.Is there any difference between normal user's phone and issue user's phone?
5.Did you try to help her to reinstall Microsoft Authenticator on her phone then check if the same issue happen again?

Answer 3

As I've mentioned a few times now - it only happens when she disconnects from a Remote Desktop Gateway session. Otherwise, it NEVER happens.
No other users have reported this same issue.
I've found no difference is any settings.
I've found no difference is phone settings.
I just talked to her this morning about reinstalling the app and redoing the initial MFA setup as it happened to her again this weekend when she disconnected from a RDG session. I will report back once we have done that.

Many prompts for Approval from Microsoft Authenticator app with MFA

2 additional answers

Activity