SOLVED

MFA and Azure B2B

%3CLINGO-SUB%20id%3D%22lingo-sub-293093%22%20slang%3D%22en-US%22%3ERe%3A%20MFA%20and%20Azure%20B2B%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-293093%22%20slang%3D%22en-US%22%3EI%20wonder%20this%20too...%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-215533%22%20slang%3D%22en-US%22%3ERe%3A%20MFA%20and%20Azure%20B2B%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-215533%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20there%2C%3C%2FP%3E%3CP%3EAny%20update%20on%20this%3F%20Do%20we%20have%20an%20idea%20of%20when%20this%20will%20be%20available%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-214948%22%20slang%3D%22en-US%22%3ERe%3A%20MFA%20and%20Azure%20B2B%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-214948%22%20slang%3D%22en-US%22%3E%3CP%3EHey%20Sarat%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt%20has%20been%2012%20months%20since%20your%20post%20-%20my%20company%20wishes%20to%20leverage%20this%20ability%20to%26nbsp%3B%3CEM%3Etrust%3C%2FEM%3E%20a%20partner%20company%20MFA.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20progress%20on%20this%20item%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECheers%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EShane%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-85244%22%20slang%3D%22en-US%22%3ERe%3A%20MFA%20and%20Azure%20B2B%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-85244%22%20slang%3D%22en-US%22%3E%3CP%3EHI%20Alexander%20-%20thanks%20for%20the%20question!%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ECurrently%2C%20MFA%20is%20managed%20at%20the%20resource%20tenant%20-%20that%20is%20the%20tenant%20that%20has%20invited%20the%20B2B%20user.%20This%20allows%20the%20organization%20to%20work%20with%20users%20with%20social%20IDs%20and%20with%20partners%20that%20don't%20have%20MFA%20capabilties%20and%20partners%20whose%20MFA%20policies%20that%20the%20resource%20tenant%20may%20not%20trust.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20does%20mean%20that%20if%20the%20user%20has%20an%20MFA%20profile%20with%20the%20partner%20org%20already%20-%20they%20will%20still%20have%20to%20re-register%20with%20the%20resource%20tenant%2Finviting%20organization.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%20are%20looking%20into%20enabling%20the%20resource%20tenant%20to%20trust%20certain%20partner%20organizations'%20MFA%20so%20that%20the%20users%20from%20these%20partner%20companies%20do%20not%20have%20to%20re-register%20and%20can%20use%20their%20existing%20MFA%20profile.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHope%20that%20helps.%3C%2FP%3E%0A%3CP%3ESarat%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-85234%22%20slang%3D%22en-US%22%3EMFA%20and%20Azure%20B2B%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-85234%22%20slang%3D%22en-US%22%3E%3CP%3EIf%20you%20enfore%20MFA%20on%20a%20B2B%20user%20via%20AAD%20conditional%20access%20and%20the%20user%20cant%20use%20the%20already%20confiured%20MFA%20app%20%2F%20MFA%20options.%3C%2FP%3E%3CP%3EThey%20have%20to%20register%20for%20MFA%20again%20and%20even%20end%20up%20with%20two%20entries%20in%20the%20Authenticator%20App%20if%20used.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAre%20you%20looking%20to%20improve%20this%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-85234%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EB2B%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Highlighted
Occasional Contributor

If you enfore MFA on a B2B user via AAD conditional access and the user cant use the already confiured MFA app / MFA options.

They have to register for MFA again and even end up with two entries in the Authenticator App if used.

 

Are you looking to improve this?

4 Replies
Highlighted
Best Response confirmed by Alexander Filipin (Occasional Contributor)
Solution

HI Alexander - thanks for the question!

 

Currently, MFA is managed at the resource tenant - that is the tenant that has invited the B2B user. This allows the organization to work with users with social IDs and with partners that don't have MFA capabilties and partners whose MFA policies that the resource tenant may not trust.

 

This does mean that if the user has an MFA profile with the partner org already - they will still have to re-register with the resource tenant/inviting organization.

 

We are looking into enabling the resource tenant to trust certain partner organizations' MFA so that the users from these partner companies do not have to re-register and can use their existing MFA profile.

 

Hope that helps.

Sarat

Highlighted

Hey Sarat,

 

It has been 12 months since your post - my company wishes to leverage this ability to trust a partner company MFA.

 

Any progress on this item?

 

Cheers

 

Shane

Highlighted

Hi there,

Any update on this? Do we have an idea of when this will be available?

Highlighted
I wonder this too...