azure-ad-b2b

How to enforce MFA only where the home directory requires it

I have an app that uses Azure AD B2B. Some guest directories require MFA logins, others do not. When signing in to my application, this is not enforced/required. Users that belong to an organisation that normally requires MFA are not prompted.

Azure B2B has the option to require MFA, but this would set it for all guest organizations. Is there an option to force Azure B2B to respect the requirements of the guests home directory?

Solution

  • Azure B2B has the option to require MFA, but this would set it for all guest organizations. Is there an option to force Azure B2B to respect the requirements of the guest's home directory?

    To assign the MFA to only selected B2B users in Azure AD B2B, you can follow the below steps.

    To automatically move B2B users to a group instead of doing it manually, you can use a dynamic group. This group will move users to a particular group based on matching certain values.

    1. I have created a Dynamic group for moving B2B users to group automatically as below.

    Go to Azure Portal > Azure Active Directory > Groups > New Group

    enter image description here

    1. External User creation enter image description here

    2. Create a conditional access policy and assign it to the group as below.

    Go to Azure Portal > Azure Active Directory > Security > Conditional Access > New policy.

    enter image description here enter image description here

    When I try to access the application, it forces me to register for MFA as below.

    enter image description here