Nov 22 2021 02:02 AM
Nov 22 2021 02:02 AM
i'm trying to configure Conditional Access for our users. We have Windows 10 managed Notebooks, which are AAD Joined and have Windows Hello for Business configured, which everything is just working fine.
We would like to configure a Conditional Access Policy to force the users every 23 hours to enter their password and MFA again. For that i have configured a policy, where i Grant the permission only with MFA and a compliant device.
But the users are not promped to enter the MFA again. I can see that the correct policy has been hit (see the second printscreen).
Is there anything i could have misunderstand or should this work like we would need?
Many thanks for any hints on this
Nov 22 2021 01:03 PM
Nov 22 2021 09:19 PM
this is what i would like to have, except that we would like to have for Windows 10 MFA in addition.
Nov 22 2021 11:50 PM
Dec 03 2021 01:15 PM
i'm sorry for the late reply. We saw in the SignIn-Logs, that the "Windows Sign In" with Windows Hello for Business, which we use, is registered as "Single Factor Authentication", but shows "MFA requirement satisfied by claim in the token".
So i assume that probably Windows Hello for Business is causing this, but i'm not sure. Also because of this in the Conditional Access overview it shows those "Windows Sign In" as "Out of scope", which is a little odd.
Also i discovered, that i don't have enabled MFA for the individual users in AAD, but the Users needed to setup MFA because the Conditional Access policy initially. Is it necessary to enable or even enforce MFA for all users in AAD?
Dec 04 2021 12:04 AM - edited Dec 04 2021 12:25 AMSolution
Yes, all users should be forced to use MFA. Here's an article I found just now which explains it all as you're on WHFB, much better than if I would give it a go! https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/why-are-my-users-not-prompte...
Going forward, try out the What if tool and the Report-only option when you experience odd stuff. Perhaps you'd benefit using the new CA templates in preview too. Have a look https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-acces... (the article was updated recently but you'll see those that are common to use if you scroll down)
As sign-in frequency also includes MFA nowadays you should be able to get this working.
Dec 08 2021 10:55 AM
Thanks for that and your help on this. The only thing which is a little special that it shows that the Windows Sign In with Hello for Business is Single Factor and not Multi Factor, but has the MFA accepted. Would be better for the understanding, or what do you think?
Dec 08 2021 12:28 PM