MFA disabled, but Azure asks for second factor?!
I just had a Teams call with a customer to resolve a strange mystery about Azure MFA.
The customer called me and explained, that he has a user with Azure Multifactor Authentication (MFA) disabled, but when he logs in with this account, he is asked to setup MFA. He setup MFA and was able to login according to their Conditional Access policies.
The customer and I took a look into their tenant and checked a couple of things. The first thing the customer showed me was this screen:
Patrick Terlisten/ vcloudnine.de/ Creative Commons CC0
As you can see, the MFA state for this user is “disabled” (german language screenshot). Then we tool a look using the MSOnline PowerShell module.
PS C:\Users\p.terlisten> $x = Get-MsolUser -UserPrincipalName user@domain.tld
PS C:\Users\p.terlisten> $x.StrongAuthenticationMethods
ExtensionData IsDefault MethodType
------------- --------- ----------
System.Runtime.Serialization.ExtensionDataObject False OneWaySMS
System.Runtime.Serialization.ExtensionDataObject False TwoWayVoiceMobile
System.Runtime.Serialization.ExtensionDataObject True PhoneAppOTP
System.Runtime.Serialization.ExtensionDataObject False PhoneAppNotification
The user has MFA enabled and the second factor is an authenticator app on his phone.
Schrödinger’s MFA
The mystery is not a mystery anymore if you take into account that the first screenshot is the screenshot of the Per-User MFA.
The customer is using Conditional Access, therefore Security Defaults are disabled for his tenant. Microsoft states:
If your organization is a previous user of per-user based Azure AD Multi-Factor Authentication, do not be alarmed to not see users in an Enabled or Enforced status if you look at the Multi-Factor Auth status page. Disabled is the appropriate status for users who are using security defaults or Conditional Access based Azure AD Multi-Factor Authentication.
Conditional Access, or enabled Security Defaults, will force a user to enroll MFA, even if the per-user MFA setting is set to “disabled”!
You have to disable Security Defaults, and you have to disable Conditional Access in order to get per-user MFA reflect the current state of MFA for a specific user.