Add multifactor authentication (MFA) to a customer-facing app

Article
10/23/2023

Multifactor authentication (MFA) adds a layer of security to your customer-facing applications. With MFA, customers who sign in with a username and password are prompted for a one-time passcode as a second verification method. This article describes how to enforce MFA for your customers by creating a Microsoft Entra Conditional Access policy and adding MFA to your sign-up and sign-in user flow.

Note

If you want to enable MFA, set your local account authentication method to Email with password. If you set your local account option to Email with one-time passcode, customers who use this method won't be able to sign in because the one-time passcode is already their first-factor sign-in method and can't be used as a second factor. Currently, one-time passcode is the only method available for MFA in customer tenants.

Prerequisites

A Microsoft Entra customer tenant (if you don't have a tenant, you can start a free trial.
A sign-up and sign-in user flow.
An app that's registered in your customer tenant, added to the sign-up and sign-in user flow, and updated to point to the user flow for authentication.
An account with Conditional Access Administrator, Security Administrator, or Global Administrator privileges to configure Conditional Access policies and MFA.

Create a Conditional Access policy

Create a Conditional Access policy in your customer tenant that prompts users for MFA when they sign up or sign in to your app. (For more information, see Common Conditional Access policy: Require MFA for all users).

Sign in to the Microsoft Entra admin center as a Conditional Access Administrator, Security Administrator, or Global Administrator.
If you have access to multiple tenants, use the Settings icon in the top menu to switch to your customer tenant from the Directories + subscriptions menu.
Browse to Identity > Protection > Security Center.
Select Conditional Access > Policies, and then select New policy.
Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.
Under Assignments, select the link under Users.

a. On the Include tab, select All users.

b. On the Exclude tab, select Users and groups and choose your organization's emergency access or break-glass accounts.
Select the link under Cloud apps or actions.

a. On the Include tab, choose one of the following options:
- Choose All cloud apps.
- Choose Select apps and select the link under Select. Find your app, select it, and then choose Select.
b. Under Exclude, select any applications that don't require multifactor authentication.
Under Access controls select the link under Grant. Select Grant access, select Require multifactor authentication, and then choose Select.
Confirm your settings and set Enable policy to On.
Select Create to create to enable your policy.