This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(310.4, 66%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJM%3C/text%3E%3C/svg%3E)
Hi,
I have an application that was using Azure SSO/MFA and for several reasons I had to move it back to on premises ADFS, Keeping Azure MFA, authetication works for most users, but I have a few using hard oath tokens and they get an error like this , when trying to login:
Authetication attempt failed. Select a different sing in option.
Did they add the token as an authentication method to their accounts?
What do the Azure Sign in Logs show?
In azure I only see Email, Phone Number and Temporary access pass , as valid methods under their accounts, no option to add a hard token.
I have assigned the hard token to the user in Azure under security>mfa>oath tokens, the token is shown as activated.
There are no logs in azure indicating this failures.
Is there a way to add an oath token to the user account other than there in MFA>Oath tokens?
in ADFS this is the only event
Log Name: AD FS/Admin
Source: AD FS
Date: 20.04.2022 14:14:46
Event ID: 364
Protocol Name:
Saml
Exception details:
Microsoft.IdentityServer.AuthenticationFailedException: Unexpected SAS response status code.
at Microsoft.IdentityServer.Adapter.AzureMfa.AuthenticationAdapter.BeginAuthentication(Claim identityClaim, HttpListenerRequest request, IAuthenticationContext authContext)
at Microsoft.IdentityServer.Web.Authentication.External.ExternalAuthenticationHandler.Process(ProtocolContext context)
at Microsoft.IdentityServer.Web.Authentication.AuthenticationOptionsHandler.Process(ProtocolContext context)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)