Multifactor Authentication
68 TopicsGlobal Administrator MFA recovery not possible
Since Microsoft automatically enforced MFA on administrator role in Azure you can end up in the situation where it is no longer possible to recover your tenant. If your only account on that tenant is with Global Administrator role and you accidentally loose your MFA, the only way is to call Microsoft support. Support on the phone is automated where any question regarding Azure is redirected to visit Azure portal. If your only user cannot login then Azure portal is not accessible.68Views1like1CommentAuthenticator not displaying numbers on MacOS
I'm have an issue with MFA on a Mac (all the latest versions). We have conditional access policies in place, so once a day I'm prompted for MFA (I work off-site) and the Office app (e.g. Outlook, Teams) will create the pop-up window that 'should' display a number that I then match on my phone. My phone see's the push notification, but the Mac never creates the numbers in the first place. The pop-up is there, just no number. The workaround is: Answer 'its not me' on the phone On the Mac, select 'I can't use Authenticator right now' Tell the Mac to send a new request This time it creates the number and I can authenticate on the phone. It only appears to happen for the installed Office applications i.e. if I'm accessing applications/admin-centre via the browser, then the pop-up is within the browser and everything works first time. Is this a known issue?226Views1like2Commentspasswordless together with MFA
edit: was an issue using edge under linux which has now support for FIDO2 tokens. you need to use chrome, when login into azure using a linux client. Hi, we are running a CA which enforces MFA through MS-Authenticator App for all users. We would like to set up an alternative way through FIDO2 tokens (passwordless). We still do have users without smart-devices and we also want a soft way for migration. Right now the passwordless login fails because the CA enforces MFA for all users. Is there a way to solve this problem? Or do we have to choose for one to authenticate way for all users? My first idea is to configure the CA so it excludes certain users from the policy? Make a group for passwordless users and exclude them from MFA. Is this the way to go or are there better solutions? Would it be possible to generate this group dynamically for all the users with at least one FIDO2 token in their authentication methods? Or would this idea mean that we have to set this group manually? What are the consequences if an user has MFA and FIDO2 within its authentication methods? Thanks for any answers and any solution. Cheers SebastianSolved3.8KViews0likes8CommentsProblem with multi-factor authentication
Hello, I am a registered and active Microsoft Partner with ID 1822164. I have two-factor authentication through the Authenticator app on my mobile phone. The phone is currently down and I can't log into partner.microsoft.com. I have a new phone with Authenticator installed but I can't make any changes to the account. I can provide any necessary identification information, my name and password are valid. Where can I request to turn off two-factor authentication to sign in and add my new phone?202Views0likes0CommentsProblems Logging In Due to Multi-Factor Authentication
At the moment, I am unable to log in to Azure with my account (Global Administrator). Although I am also a Microsoft Partner and have 10 credits for support requests, I cannot create a support request here. Therefore, I have to post in this forum. I can log in to Office 365, PowerApps, Power Automate, and other services with MFA without any issues. However, when I log in to portal.azure.com, I am prompted for authentication again immediately after logging in, and I cannot proceed further from there. I have created two tickets with Office 365 and Microsoft Entra ID, but neither ticket has successfully resolved the issue. Here is what we have tried so far: Disabled MFA, but MFA still appears. Successfully removed my guest account from other organizations. The problem still persists. What can I do here? Can Microsoft Azure contact me since I still have 10 credits?886Views0likes5CommentsEnable Windows Hello in Hybrid Environment
Hi all, we are planning to enable Windows hello for our hybrid ad joined devices. I have below questions around it before proceed with it. appreciate anyone's help. Does certificate or Cloud Kerberos configurations is a must thing? Can't we enable Windows-Hello from Microsoft Intune like we do for Azure AD standalone devices. Do we need to consider anything important if we go forward with Cloud Kerberos configurations (it seems this is the only method we don't need certificate). Because we have around 20+ domain controllers in our environment, including RODCs. Can I please have Pros and Cons of enabling Windows Hello for Hybrid environment? Thanks in advance! DilanSolved5.7KViews0likes6CommentsWhenever login into the office applications different OTP needs to be applied Outlook and teams
When signing into Office applications, a different OTP is required for both Outlook and Teams. To address this issue, there is any resolution this issue supports or a supporting document as proof to confirm that this is a standard procedure.429Views0likes1CommentUsing CBA with a device certificate on Windows Server
Hi, will it be possible to use CBA as "filter for devices" some day? e.g. A Windows Server which is not hybrid joined or managed by Intune could then be identified as a "valid device" which is allowed to access Admin portal. Like a RADIUS Auth. BR Stephan356Views0likes2CommentsPhase out text message / SMS for MFA (no hard break)
Hi everyone, is it possible to phase out SMS in rings? We still have too many users using text message as their first auth method. We are "nudging" and we are sending campaings "how to change", but we want to get the last ones to change. Is there any way to just restrict the usage of SMS in ring - so the first ring is 500 employees. The next one 1000 etc. Instead of just switching it to off? We would expect a high amount of service desk calls if we just switch it off. Best regards StephanSolved4.5KViews1like11CommentsVirtual Smart Card for Application 2FA
Is it possible to use VSC's for application 2FA? My understanding is that operating system sign-in is relatively straight forward (although there's no option to use username/ password with the VSC, only PIN). Create the certificate template Create the TPM virtual smart card using tpmvscmgr.exe Enrol for the certificate on the TPM Virtual Smart Card295Views0likes0Comments