Lync.exe failing MFA

[lfkentwell]

Recently we implemented MFA and all the sudden i get loads of failed logins with Browser identified as Lync.exe with the failure "User did not pass the MFA challenge (non interactive)."

Clearly Lync is the old version of Skype for Business.  If this is failing wouldn't the person be having issues with their Lync not working?  I would have thought so but no one is complaining.

[#2]

They might not be using S4B.

Have you enabled modern auth?

[#3]

Yes we did have Lync but have since moved to S4B. the desktop guys say everyone has been updated but maybe that’s not the case.

Simple question, does Lync support modern auth?

[#4]

Last time I checked, the S4B client still presents itself as lync.exe in the AAD sign-in logs.

S4B support modern auth.

[#5]

@Thijs Lecomte that kind of makes sense.  Looking at the S4B in the task manager the running the process for S4B appears to be Lync.exe

However you say S4B supports modern auth but when i look at AzureAD logs it fails MFA as non interactive.  The entry says "User did not pass the MFA challenge (non interactive)."

So based on this I would expect S4B to not work yet it does.  Kind of contradictory.

[#6]

have you enabled modern auth in S4B?
https://www.ronnipedersen.com/2017/07/11/enable-modern-authentication-for-skype-for-business-online/

[#7]

Hi

We also have legacy auth in the AAD sign-ins for lync.exe for one of our client ad for almost all their users.

S4b is on-prem (not sure if in hybrid mode yet) + Mailboxes in Exchange Online (hybrid mode with a few service mailboxes on the on-prem Exchange server) + ADFS for authentication.

We want to enable MFA using Conditional access policies but we first need to get rid of these legacy authentications from lync.exe.

Anybody can confirm that going through the following procedure will enable Modern Auth for lync.exe without impacting the services?
https://docs.microsoft.com/en-us/microsoft-365/enterprise/configure-skype-for-business-for-hybrid-mo...

Anything else to consider?

Thank you for you help.

[#8]

Have you checked this registry settings?
https://docs.microsoft.com/en-us/skypeforbusiness/troubleshoot/hybrid-exchange-integration/allowadal...

[#9]

Great! It seems to work! Really appreciate you input here Thijs 🙂