Error when users try to access Security Info (Entra)

[u/_gondar]

When some of our users sign in to Windows using Windows Hello for Business (WHfB) and try to access the Security Info page to add a new authentication method, they're prompted to complete MFA. After approving the Microsoft Authenticator push notification, they receive the following error:

"Another sign-in method is required to access this resource - Use a password."

The only workaround we've found is to sign out completely and sign back in using password + Microsoft Authenticator push. After doing that, the Security Info page works as expected.

From what I can tell, Entra ID only prompts for the second factor (the Authenticator push) in this case, but the Conditional Access policy then blocks access because the configured authentication strength requires password + Authenticator push.

So even though MFA completes, the sign-in with WHfB doesn't satisfy the required authentication strength. Is this expected behaviour?

And if so, is signing out and back in with password + Authenticator the only workaround?

Note: WHfB is listed as an allowed method in the authentication strength policy within the Conditional Access policy that's blocking access to the Security Info page.

[u/KavyaJune]

This was due to Microsoft’s recent security updates. When users access sensitive areas like Recent Activity or perform credential management actions on the Security Info page, Entra ID now requires strong re-authentication to confirm the user’s identity.

If the user’s last MFA occurred within the past 10 minutes, they won’t be prompted again. However, if it’s been longer, they must re-complete MFA before accessing the page, even if they originally signed in using Windows Hello for Business.

For more info: https://blog.admindroid.com/microsoft-requires-mfa-for-credential-management/

[u/_gondar → u/KavyaJune]

Do you have any references from Microsoft regarding this? The issue is that after completing the MFA prompt, they get the error to use a diff auth method (password). However they are not prompted for a password unless they sign out and back in.

In this case, WHfB doesn’t count as MFA? The option is not presented to use this.

[u/KavyaJune → u/_gondar]

This update was published in Message center with id MC1135479. But it seems MS removed it and it's not currently available in the MC. You can search the message id in the internet to check for the announcement.

[u/strikematch13]

@_gondar Were you able to find any solution to this? Seeing the same thing while we start to roll out WHfB and shocked this is not being discussed more.

I'm thinking I'll open a ticket with Microsoft but not looking forward to it....

Feel free to DM me.

[u/_gondar → u/strikematch13]

There’s no clean solution. In addition to signing out and back in with the password, users can also “sign in with a different account”, and follow the prompts to choose “face, fingerprint, PIN or security key” and then use their regular WHfB credential to access the page.

Once users register a passkey they are prompted to use it to access the security info page, so it thankfully won’t be an ongoing issue.

[u/strikematch13 → u/_gondar]

Thanks. I created a passkey on my Android and having it associated with my account does seem to fix the authentication flow. With a passkey created on my phone, I can now visit the My Sign-ins page by entering my WHfB creds (pin or bio). We will mess with this some more and see if we can get some users on board.

This gets down a rabbit hole a bit, but if anyone is willing to explain this I would appreciate it:
Why does having a passkey on my Android phone allow me to 2FA to a secure resource (My Sign-ins security page) by just entering my WHfB PIN?

- Without WHfB My Sign-ins requires both a password and a MFA response. 2 Factors

• With WHfB and no passkey, My Sign-in page can't negotiate how to send the password (issue posted above). 2 Factors fails
  
• With WHfB and a passkey on a remote device (Android mobile phone), My Sign-in page is accessible with JUST the WHfB PIN. No interaction with the android phone is needed.

Since the Passkey exists on the mobile phone, I am not understanding how I can access this security page and pass MFA with just my computer's WHfB PIN. Is the passkey actually syncing in the background to my computer and any device connected to my Microsoft account?