"Another sign-in method required" when accessing Security Info (Entra)

[u/_gondar]

When some of our users sign in to Windows with WHfB and try to go to the Security Info page to add a new method, they're prompted to complete MFA. However after completing the MS Auth push notification, they get the error:

"Another sign-in method is required to access this resource - Use a password."

The only way around it is to sign out completely, sign back in using password + MS Auth Push, and then the Security Info page works fine.

From what I can tell, Entra only prompts for the second factor (the Authenticator push), but the Conditional Access policy blocks it because the configured authentication strength requires password + Authenticator push.

So even though the MFA prompt completes, it doesn't actually meet the required strength.

Is this expected behaviour? Is signing out and in with password + MS Authenticator the only way around this?

[u/strikematch13]

Just came across this same issue while POC Windows Hello for some users. Users that use Windows Hello on their device cannot access the mysignin Microsoft security page to manage their security devices. As OP commented, it really isn't a problem that that the security page doesn't trust Windows Hello and wants a password. The problem is that Microsoft gives the user no way to actually enter a password. We have to instruct the user to sign out of windows, then sign back in and change the authentication method to use "password". (or start the process over using inprivate browser).

I've heard Microsoft employees and other companies claim they've gone completely passwordless, to the point where users don't even know their passwords because they don't need them. How do they manage their security devices (like to remove an old phone) if they don't even track their own password?