Azure AD B2C MFA 强制执行不起作用

Question

We want to have some users required to use MFA and some users that can log without. For this we have two groups "MFA Required" and "MFA Not Required". When we want to active MFA for a user, we simply move them from one group to the other. We have a conditional access that enforces the MFA.

The includes/excludes:

The grant:

The User flow:

The issue is that now I get the MFA screen for all users. The "MFA Enforcement" even says "Conditional delegates the MFA decision to conditional access policies." when hovering above the "i". When I check the option "Enforce conditional access policies" in the User Flow nothing changes.

What is going on here? I feel I'm missing something, but I can't find anything online.

EDIT: I checked the audit logs in azure and when I log in with the user from "MFA Required" I see this:

And for the user from "MFA Not Required" I see this:

I still get the MFA screen for both though.

Answer 1

The reason behind getting MFA screen for all users may be due to below:

• Check whether you have enabled per-user MFA to the users.

• Please note that, if you are conditional access policies you should not enable/enforce per-user Azure Ad MFA.
• If you have enabled that option, the user might get MFA screen even they are excluded via conditional access policies.
• Check whether you have enabled security defaults option. If enabled, make sure to disable it.

Please check whether Self-Service Password Reset is enabled. Make sure to disable it.

For more in detail, please refer below links:

Enable per-user Multi-Factor Authentication - Azure Active Directory | Microsoft Docs

Disable Azure AD MFA Interrupt Mode for a group of users - Stack Overflow

Answer 2

RukminiMr-MT answer helped me gather a lot of information.

I had contacts with people from Microsoft and the thing is that when you use the Authenticator app as MFA option every user will have to register their authenticator app as MFA solution the next/first time they log in (after the change).

After they registered it for the first time they'll never get the MFA screen again. It's just a one time thing. The second time they log in, only the users from my MFA list get the MFA screen.

Check the date of this answer, since there are items in preview everything I just said might already have changed.