Forum Discussion
MFA denied; duplicate authentication attempt
We see a lot of entries in the Entra ID Sign in logs with "MFA denied; duplicate authentication attempt". Most of the time a lot of them are registered in a short amount of time
Users are not (yet) complaining. May be users don't even see something wrong.
Anyone who knows what this means? (MFA denied; duplicate authentication attempt)
kind regards
Jurgen
3 Replies
What is your method of enforcing MFA for your user's account? Users might not notice any issue as long as they are able to authenticate. So, as the administrator, you should revoke the user's session which will require the user to sign in again.
If you are using conditional access policy to enforce MFA, you could modify the sign in frequency so the user will be required to sign in again after a shorter period of time but do well to inform the affected user(s).
I hope this helps!
- Thank you for your suggestion, however the entries in the sign in logs are for active users on an active device. I cannot find a relation to stale devices.
