Creating New-PSSession is not working with an app password for MFA enabled account (MFA Type : Authenticator App).

Question

Creating New-PSSession is not working with an app password for MFA enabled account (MFA Type: Authenticator App).

Users having the following privileges.
Role: Global Administrator
Permissions:
Compliance Management (Audit Logs).
Organization Management (View-Only Audit Logs).

While creating new-PSSession getting error(Screenshot attached) in Powershell

When I use the initial app password given by Azure when registering of MFA, It's working fine (Newly created app password not working)

Answer 1

App passwords should not work for any admin endpoints, that's a default security limitation that cannot be lifted. Moreover there's absolutely no reason to keep using app passwords, ExO Remote PowerShell has supported modern auth/MFA for years now.

Answer 2

Here is the document that references the issues with app passwords ( and Vasil's spot-on point)

https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-app-passwords

When you use app passwords, the following considerations apply:

There's a limit of 40 app passwords per user.
Applications that cache passwords and use them in on-premises scenarios can fail because the app password isn't known outside the work or school account. An example of this scenario is Exchange emails that are on-premises, but the archived mail is in the cloud. In this scenario, the same password doesn't work.
After Azure Multi-Factor Authentication is enabled on a user's account, app passwords can be used with most non-browser clients like Outlook and Microsoft Skype for Business.
However, administrative actions can't be performed by using app passwords through non-browser applications, such as Windows PowerShell. The actions can't be performed even when the user has an administrative account.
To run PowerShell scripts, create a service account with a strong password and don't enable the account for two-step verification.

The last sentence can be mitigated by using the latest V2 PS ExO module that supports Cert-Based Auth using an Azure App:

https://techcommunity.microsoft.com/t5/exchange-team-blog/modern-auth-and-unattended-scripts-in-exchange-online-powershell/ba-p/1497387
https://www.quadrotech-it.com/blog/certificate-based-authentication-for-exchange-online-remote-powershell/

Answer 3

If you are using Conditional Access to enforce MFA, app passwords do not work. Is that the case here?

Answer 4

No, the security defaults arent the same thing as a Conditional Access policy.

You still cant use an app password for what you are trying to do. See the links and information I have already posted above

To run PowerShell scripts, create a service account with a strong password and don't enable the account for two-step verification.

The last sentence can be mitigated by using the latest V2 PS ExO module that supports Cert-Based Auth using an Azure App:

https://techcommunity.microsoft.com/t5/exchange-team-blog/modern-auth-and-unattended-scripts-in-exchange-online-powershell/ba-p/1497387
https://www.quadrotech-it.com/blog/certificate-based-authentication-for-exchange-online-remote-powershell/

Answer 5

Sorry, I didn't see you updated this a few days ago.
I think you are misunderstanding those docs. There are no accounts used and MFA doesn't apply if using that new process. You create an app in Azure and use a certificate to authenticate and secure it.

If you want to use a Service Account instead, then don't MFA-enable it.

You have those two choices:

1. You would either user a service account and password that doesnt have MFA enabled ( and you could create a Conditional Access policy to limit the connecting account to "trusted networks" )

2, or use the V2 latest update and cert-based auth and an Azure app:

I prefer 2