azure-active-directory multi-factor-authentication

Does having multi-factor authentication (MFA) enabled on my Azure Tenant force users of my multitenant Azure AD app to use MFA too?

My Azure AD tenant has multi-factor authentication (MFA) enabled. I have create an app with an Azure AD App Registration configured as multitenant using the option "Accounts in any organizational directory (Any Azure AD directory - Multitenant)".

The question is, when a user from another tenant logs into to my app to provide consents etc., are they forced to use MFA even if their Azure AD tenant does not require MFA?

In other words, for an Azure AD app registration configured as a multitenant app, which tenant's MFA policies are applied, the tenant where the app exists or the tenant of the user using the app.

Also, related to this SHOULD I have a separate tenant for my multitenant Azure AD apps anyway?

Solution

I created an Azure Active Directory Multi-Tenant Application in the TenantA:

enter image description here

In the TenantA, I enabled the Multi Factor Authentication:

enter image description here

I used the below endpoint to authorize the users:

https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?
&client_id=ClientID
&response_type=code
&redirect_uri=https://jwt.ms
&response_mode=query
&scope=https://graph.microsoft.com/.default
&state=12345

I tried to authorize the TenantA user and got the multi-Factor prompt:

enter image description here

Now, I tried to authorize the TenantB user, the user got the consent like below:

enter image description here

The TenantB user dint get the MFA prompt and got signed-in successfully like below:

enter image description here

Note that: The MFA policies are based on the tenant of the user not the tenant where the Azure AD App registration exists.

The MFA policy of the tenant where the user exists is applied.
If the TenantB has MFA enabled, then the user will get MFA prompt.
Hence, when a user from another tenant logs into to the app to provide consents, they are not forced to use MFA if their Azure AD tenant does not require MFA.

Also, related to this SHOULD I have a separate tenant for my multitenant Azure AD apps anyway?

Normally, it is not required to have a separate tenant to create Multi-Tenant Azure AD Applications. It is based on your requirement to create a new tenant or not. By creating a new tenant for multi-Tenant apps allows to do detail management of the app's permissions and applications.