azure-active-directoryazure-ad-b2cmulti-factor-authentication

Azure AD B2C MFA enforcement doesn't work

We want to have some users required to use MFA and some users that can log without. For this we have two groups "MFA Required" and "MFA Not Required". When we want to active MFA for a user, we simply move them from one group to the other. We have a conditional access that enforces the MFA.

The includes/excludes:

enter image description here

The grant:

enter image description here

The User flow:

enter image description here

The issue is that now I get the MFA screen for all users. The "MFA Enforcement" even says "Conditional delegates the MFA decision to conditional access policies." when hovering above the "i". When I check the option "Enforce conditional access policies" in the User Flow nothing changes.

What is going on here? I feel I'm missing something, but I can't find anything online.

EDIT: I checked the audit logs in azure and when I log in with the user from "MFA Required" I see this:

enter image description here

And for the user from "MFA Not Required" I see this:

enter image description here

I still get the MFA screen for both though.

Solution

  • RukminiMr-MT answer helped me gather a lot of information.

    I had contacts with people from Microsoft and the thing is that when you use the Authenticator app as MFA option every user will have to register their authenticator app as MFA solution the next/first time they log in (after the change).

    After they registered it for the first time they'll never get the MFA screen again. It's just a one time thing. The second time they log in, only the users from my MFA list get the MFA screen.

    Check the date of this answer, since there are items in preview everything I just said might already have changed.