Inconsistent MFA behaviors

Question

We have all of our users on Intune joined devices. They're all in the office where the office IPs are whitelisted. They're all applied to the same conditional access policies.

Some users will get no MFA prompts at all while in office. Others who are also in office will get MFA prompts. Some getting them 3 times a day. Entra logs show consistently show "Token Protection - Sign In Session Status" as 1002 when the user gets prompted.

This only happens when using Google Chrome. Any ideas? Let me know if you need more information.

Answer 1

Any help from:

https://www.michaelvink.com/l/conditionalaccesstokenprotection/

If you are using token protection in a CA policy consider disabling the policy and testing

https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-token-protection