Multiple consecutive MFA prompt issue
Hello !
I am currently facing an issue when I am onboarding users using a TAP and redirecting them to https://aka.ms/mysecurityinfo to register their passkey.
The issue is, once they enter their upn + TAP, they are facing two identical consecutive MFA prompt to register Authenticator (or phone) and a third MFA prompt to register an SSPR method.
I checked my Entra settings related to MFA and identified :
- Registration campaign : set to MS managed, but the users are excluded
- ID Protection MFA policy : enabled
- CAP : The users are targeted by a CAP with a custom authentication strength with TAP among other things
- SSPR is enabled for all
In that situation, my understanding is :
- User input TAP
- 1rst MFA prompt (only Authenticator or phone) = ID Protection MFA Policy -> user ignore
- 2nd MFA prompt (only Authenticator or phone) = ? -> user ignore
- 3rd MFA prompt = SSPR (as they can chose email here)
Do you have any idea why there is the second MFA prompt ? Thanks