Explore Our Microsoft Cloud Security Training →
Understanding Authentication Strength Definitions
To address issues with MFA failures caused by Authentication Strength policies, it’s essential to understand the definitions and built-in options available.
- Password Only: Requires only a password for authentication.
- Password + MFA: Requires both a password and multi-factor authentication (MFA).
- Password + MFA (requiring app registration): Same as Password + MFA, but users must have registered the required authentication methods before enforcing policies.
Pre-Requisites for FIDO2 and Windows Hello for Business
If you are using FIDO2 or Windows Hello for Business, ensure that your users have met the necessary prerequisites for these authentication methods.
Hardware Token Issues
When implementing hardware tokens, common failure scenarios may arise. Ensure that users have properly registered their tokens and that they are compatible with your organization’s configuration.
Authentication Method Registration Requirements
Ensure that all required authentication methods (Authenticator Passkey, FIDO2 security key, etc.) are registered by users before enforcing policies.
Sign-in Log Analysis
Review SigninLogs with KQL: SigninLogs | where UserPrincipalName == 'user' | extend authStrength = AuthenticationDetails to see strength evaluation.
Resolving FIDO2 Issues
For FIDO2 issues, verify cross-tenant settings if users come from external tenants.
Explore Our Microsoft Cloud Security Training →
Written by Mohammed Akhter
Founder of ITP Training. 50,000+ students trained across 30+ countries in Microsoft endpoint and cloud security. Learn more →