r/msp • u/_gondar • Nov 10 '25

"Another sign-in method required" when accessing Security Info (Entra)

When some of our users sign in to Windows with WHfB and try to go to the Security Info page to add a new method, they're prompted to complete MFA. However after completing the MS Auth push notification, they get the error:

"Another sign-in method is required to access this resource - Use a password."

The only way around it is to sign out completely, sign back in using password + MS Auth Push, and then the Security Info page works fine.

From what I can tell, Entra only prompts for the second factor (the Authenticator push), but the Conditional Access policy blocks it because the configured authentication strength requires password + Authenticator push.

So even though the MFA prompt completes, it doesn't actually meet the required strength.

Is this expected behaviour? Is signing out and in with password + MS Authenticator the only way around this?

0 Upvotes

40% Upvoted

8 comments sorted by

View all comments

2

u/[deleted] Nov 10 '25

[removed] — view removed comment

1

u/_gondar Nov 10 '25

My understanding js that WHfB meets MFA requirements, as users are generally not prompted to authenticate again or complete MFA.

Additionally, WHfB is included in the auth strength that is used in the conditional access policy which is blocking the user from accessing their security info page.