Mar 25 2022 02:11 AM
Hey everyone
Our customer has Azure AD connected devices that are set up with Intune.
We also have SSO set up for LastPass, which works without any issues.
Now the customer wants to enable MFA for portal.office.com and the LastPass browser add-in.
I set up a conditional access rule where I set the browser session settings to "never persistent". The MFA login works, but when users close the browser and reopen it, they remain logged in. This happens with portal.office.com and the LastPass browser add-in.
Could it be that they stay logged in because the devices are connected to Azure AD?
Thanks
Joël
Mar 27 2022 06:52 AM
Mar 28 2022 01:39 AM
@joeyvldn Thanks for your reply!
Most users log in to Windows with their O365 user and password. Only 1 user has WHfB enabled.
Here is how my CA policy for browser sign-ins is configured:
- Cloud apps or actions: All cloud apps
- Conditions: Client apps -> Browser
- Grant: Require multi-factor authentication
- Session: Persistent browser session -> Never persistent
The Azure AD sign-in log tells me that the conditional access policy is applied.
The auth method says "Previously satisfied" and the result is "satisfied by claim in the token".
Mar 28 2022 06:11 AM
Mar 28 2022 08:57 AM
Is this the user who is using WHfB? Windows sign-ins with WHfB are automatically protected by MFA and thus portal.office.com