Forum Discussion

Michiel van den Broek's avatar
Michiel van den Broek
Iron Contributor
Nov 03, 2020

Guest User gets MFA registration in my tenant, while having MFA in own tenant?

I'm an IT Pro, so trying new stuff all the time. Possibly turned something on that shouldn't. 🙂   Here is my problem, or something that surprised me: My own tenant has security defaults enabled, ...
Azure Active Directory (AAD)
VasilMichev's avatar
VasilMichev
MVP
Nov 03, 2020

Afaik it's by design, the reasoning being that the "resource" tenant can have specific requirements with regards to MFA, with no guarantee they will be satisfied within the "home" tenant. 

Michiel van den Broek's avatar
Michiel van den Broek
Iron Contributor
Nov 03, 2020

VasilMichev Thank you!

 

I thought about this reason. But why is it different from e.g. MAM/MDM where you require a minimum of security setting (updated, pin set, no jailbreak, etc.) before accessing your files. So, if the user doesn't have a pin code, you require him to set a pincode to unlock his device. And if he has a pincode but it's 4 digits and you require 6 digits then the user has to change his pin. It's not like he's getting a second pincode.

 

Same for MFA. If the user has allready installed Microsoft Authenticator with this Azure AD account, then don't give him a second setup. Just use the setup that belongs to his "home" account. 

 

1 username, 1 password, 1 MFA. That's already complicated enough to understand.

 

 

Resources