Forum Discussion
Access has been blocked by Conditional Access policies.
This is what happens when security defaults are enabled.
Requiring all users to register for Azure AD Multi-Factor Authentication.
Requiring administrators to do multifactor authentication.
Requiring users to do multifactor authentication when necessary.
Blocking legacy authentication protocols.
Protecting privileged activities like access to the Azure portal.
My guess here is the legacy protocols.
In general, when using conditional access policies, they should be analyzed before turning them on, such as "report-only" mode to see what will happen. Let's say you have apps that doesn't support modern authentication, or your environment is enabled for modern authentication, if you then disable all legacy protocols... another example could be trying to sign in from a location that isn't specified in the trusted locations in the CA policy and so on.
To be able to configure CA policies though one cannot use Azure AD free (security defaults) as Azure AAD P1 is required.
see my previous reply I did ended up finding the user on the risky sign-in page though as they had been trying to avoid the auth app requirement. So this is my suspicion although you'd never know this from looking anywhere in the logs, I just went hunting and found the user listed.
I've removed them and waited a short while before asking the user to try again.
Oh yeah P1 / P2 the licence MS does not know what to do with.
I currently have a small essay with my reseller asking them how the heck we are supposed to be licencing these as things keep disappearing behind the you need a P1 licence for that and the licence terms so so unclear as to who needs what.
- Bear in mind accounts and sign-ins does not equal protocols or apps being used. From the above screenshot its security defaults involved there too, meaning it's one of those auto-policies that blocks, hence my legacy protocol guess (and they are quite many). Also, security defaults require registering for MFA within 14 days. After registration Azure AD decides when a user will be prompted for multifactor authentication, based on factors such as location, device, role and task.
Feel free to update the conversation when/if you find the solution.
Adding this for reference https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/block-legacy-authentication
