Handling Multi-Factor Authentication

[olimjonbakirov]

Hi,
I started getting an error while trying to acquire Access Token since we have some of our Azure accounts moved to Multi-Factor Authentication.
The Error message is:
interaction_required AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '00000002-0000-0000-c000-000000000000' ...
Could you please help on how to handle this?
Thank you,

[decomplexity]

Looks at first glance that the MFA token lifetime has expired on a trusted device and that each time the client tries to access the (old) Graph API during authentication, it demands re-authentication

[olimjonbakirov]

Looks at first glance that the MFA token lifetime has expired on a trusted device and that each time the client tries to access the (old) Graph API during authentication, it demands re-authentication

The flow redirects to login page. After successful login, I am redirected back with auth code. I wonder how to make it do MFA check (e.g. phone message)?

[hajekj]

You should have either security defaults or conditional access set it up in the tenant in order to achieve this. You can also enforce MFA per user via the old MFA portal

[hlecorche]

@olimjonbakirov Did you fix the problem ?

[theblindfrog]

Also bumping for this. @olimjonbakirov did you figure out how to get this to work?

[olimjonbakirov]

Also bumping for this. @olimjonbakirov did you figure out how to get this to work?

@theblindfrog and @hlecorche I was able to solve it then years ago. As far as I remember the solution was to add 'scope' and I think 'User.Read' was mandatory for MFA to work.
$this->client = new \TheNetworg\OAuth2\Client\Provider\Azure([
'clientId' => env('azure.client_id'),
'clientSecret' => env('azure.client_secret'),
'scope' => ['openid', 'profile', 'email', 'User.Read'],
'redirectUri' => env('azure.redirect_uri')
]);
let me know if it does not work - I can look up further.

[theblindfrog]

Thanks @olimjonbakirov, added the scopes worked for me (although through testing, I only needed 'openid' 🤷‍♂️ )