MFA is not enforced about aad-auth HOT 5 OPEN

Thanks for reporting this bug and help making aad-auth better. You are correct that as of now, MFA is not supported and enforced.

This is something we definitively want to support in future release, but it needs quite some graphical work to display additional widgets and UIs in the graphical login manager.

from aad-auth.

Even worse: When the MFA is enforced by the AAD backend, but never given by the user due to the successful login, this looks like a "PW of the user was compromised, but MFA saved the day" type of scenario to the AAD backend. This in return will increase the Identity Protection Risk Score of that user and by that – in the long run – results in blocking them.

This is a major blocker for us, preventing adaptation into our managed corporate Linux client.

from aad-auth.

If the conditional access policy/multifactor condition is not met surely the user is not authenticated and the login should be denied?

At the moment it is allowing sign in with the following noted in the Azure AD portal.

21/06/2023, 15:27:06
Password in the cloud
Succeeded: true
Correct password

21/06/2023, 15:27:06
Succeeded: false
MFA required in Azure AD

from aad-auth.

You could implement the device code flow to provide some simple MFA capabilities.

from aad-auth.

Even worse: When the MFA is enforced by the AAD backend, but never given by the user due to the successful login, this looks like a "PW of the user was compromised, but MFA saved the day" type of scenario to the AAD backend. This in return will increase the Identity Protection Risk Score of that user and by that – in the long run – results in blocking them.

I wonder if the Identity Protection Risk Score for the user is still increased if the failed auth due to MFA requirement is immediately followed by a successful MFA from the same device?

from aad-auth.