Office 365 MFA Requirements

Matt Weisberg Super User

3 months ago

Has anyone that is using NAM and AA for federated SSO to Office 365 been concerned about Microsoft's upcoming requirements to enforce MFA?

I cannot find anything very definitive on this. Some things I read seem to indicate if you set SupportsMFA to true in your domain federation settings you are fine, others seem to indicate you need to include AuthNMethodsReferences as a claim with a value of MultipleAuthN.

Matt

Tags:

access manager

Labels:

Access Manager

Top Replies

Parents

Suggested Answer

0 Sebastijan Sef 3 months ago

Hi Matt!

As far as I understand you need to have both. You need to tell Azure that your IDP is able to do MFA (SupportsMFA flag) and also tell that user has authenticated with MFA (authnmethodsreferences claim). A month ago I had a discussion about that with Jose Luis here: RE: Planning for mandatory multifactor authentication for Azure

Kind regards,

Sebastijan

Kind regards,

Sebastijan

If you found this post useful, give it a “Like” or click on "Verify Answer" under the "More" button
Cancel
Vote Up +1 Vote Down

Sign in to reply

Verify Answer

Reject Answer

Cancel
0 Matt Weisberg 3 months ago in reply to Sebastijan Sef

Thanks. I did a search and didn't find it.

Is there some way to verify that it actually is working?

I see you used a virtual attribute, are you sure those extra "bits" are required?

Matt
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Sebastijan Sef 3 months ago in reply to Matt Weisberg

You can already configure Entra to require MFA, for example https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-userstates

Regarding virtual attribute, I have created it because in early on one customer required to receive multiple values (there was a specific requirement and I have no idea anymore what was it). Then I just kept this approach because it is flexible.

Kind regards,

Sebastijan

If you found this post useful, give it a “Like” or click on "Verify Answer" under the "More" button
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 Sebastijan Sef 3 months ago in reply to Matt Weisberg

You can already configure Entra to require MFA, for example https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-userstates

Regarding virtual attribute, I have created it because in early on one customer required to receive multiple values (there was a specific requirement and I have no idea anymore what was it). Then I just kept this approach because it is flexible.

Kind regards,

Sebastijan

If you found this post useful, give it a “Like” or click on "Verify Answer" under the "More" button
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 Matt Weisberg 3 months ago in reply to Sebastijan Sef

So I tested this in my test/lab tenant. I used the Graph API to set FederatedIdPMfaBehavior to "enforceMfaByFederatedIdP". There are more options when you use the Graph API, it's not just true or false.

I also added just the one attribute as a constant like this:

<saml:Attribute xmlns:xs="">www.w3.org/.../XMLSchema"
xmlns:xsi="">www.w3.org/.../XMLSchema-instance"
Name="authnmethodsreferences"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
>
<saml:AttributeValue xsi:type="xs:string">schemas.microsoft.com/.../saml:AttributeValue>
</saml:Attribute>

I didn't even add the name space just to see what would happen.

It all works, but how can I tell if it is satisfying Microsoft's requirements?

Matt
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Menu

Access Manager Discussions

Office 365 MFA Requirements

Tags:

Labels:

Top Replies

Suggested Answer

Resources