1

Hi, I have set up mfa on a domain for a client. I created a conditional access policy and included all users that are mobile phone users. We installed the app and tested. However. A couple of users (both iPhone) when they open up any 365 app, predominately outlook, get a message asking to open authenticator. then they get a password prompt and this, though verified as the users 365 password, fails. Anyone of you kind wizards have any advice on where i can go to check why this is happening? As a workaround i took them out of the policy and even put them in the exclude but it still does the same thing.

2 Spice ups
2

Delete the 365 account in Settings-Mail-Accounts, uninstall and re-install the authenticator app, sign in to authenticator app then re-add 365 account to phone.

1 Spice up
3

Have done that with same result.

4

Well, actually the client said they deleted the app, unsure if they went that way, will find out.

1 Spice up
5

Have the user go to Sign in to your account.
Login and remove the phone from the auth.
Then have them re-add it through the same session.

2 Spice ups
6

Tried that. I actually think i might have a lead on this, the grant permission was not set to require mfa. Would that have caused it?

7

Something to consider - sometimes MS authenticator likes to prompt for MFA as well. The observed behavior of this is the user tries to sign in to O365, is required to authenticate MFA, opens MS Authenticator, and is then asked to authenticate to…authenticator. When this happens, you’ll see the two digit code in the authenticator app for like a second, and then get asked to enter the code. This is often confusing since if you don’t see the code on the mobile device you would assume it is asking for your original login code from O365. Alternatively, I would recommend reviewing (and possibly posting if necessary) the failed login attempt details from Entra, you can also see if your conditional access is being applied / satisfied for the login attempt.

2 Spice ups
8

Go to the Azure portal, navigate to Azure Active Directory > Sign-ins, and check the sign-in logs for the affected users. Look for any failed sign-in attempts and the corresponding failure reasons.

2 Spice ups
9

It seems that the require mfa tick box has done the trick, thanks for the help, all