Azure AD Windows Profile is Bypassing MFA

[Andrew1]

We've had MFA configured for a couple of years now, and are just starting to configure devices so they log into an Azure AD profile on a device with Intune.

With this configuration more or less out of the box, after logging into Windows,  the user is automatically logged into Office.com in Edge and Office products (except Outlook). In effect, it's bypassing MFA.

Is it possible to configure Windows so it requires people to authenticate with the app or text when logging into Windows, or otherwise is it possible to remove the SSO experience from Edge? We cannot allow users to get to certain SharePoint sites without 2 factors from a new windows session if we want to stay in compliance with our client's security requirements.

[#2 · Accepted solution]

It's not bypassing MFA, when you join the machine to Azure AD it requires MFA to join the machine, which can use windows hello to use the TPM chip, turning your device into something you have and your Password / PIN(Hello) as part of the MFA so you no longer have to do MFA to access your office resources from the device itself. The idea is anyone accessing your o365 account on anything other than that device or another joined device you setup, will still need to do MFA to access your resources. If your machine gets stolen lost, they must crack the password, but the machine can be disabled, which will force MFA again.

[#3]

That makes sense, as long as I can document it and defend it we should be good, so thanks for explaining. I disable Windows Hello to ensure the password complexity and password change requirements are met, but I assume BitLocker w/ TPM has the same effect as making it the 'something you have', or is there something fundamentally different about Hello?

[#4]

I don't know how "technically" it works, I just know that's expected behavior as it stores something locally I think via TPM when joining and using MFA to join the machine, which keeps you from having to do MFA for everything.

[#5]

I know :p Well, Jairo knows, and has documented it pretty well on his blog: https://jairocadena.com/2016/11/08/how-sso-works-in-windows-10-devices/

Make sure to review all the other articles as well.

[#6]

And this is why I love hanging out and participating so much on this site :face_with_tears_of_joy: thanks Vasil