Azure MFA/ADFS - one user requiring MFA even when its disabled

Question

We initially enabled Azure MFA but then disabled it due to issues.

We have one user on our Office 365 account who is still prompted for the “more information required” page when logging in. The ultimate error is “An error occurred. No valid strong authentication method found. Contact your administrator to configure and enable appropriate strong authentication provider.”

MFA is disabled for the user and disabled for the tenant (Enable security defaults is set to No).

The Event log on the ADFS server is Event 364, AD FS –

Encountered error during federation passive request.

Additional Data

Protocol Name:
wsfed

Relying Party:
urn:federation:MicrosoftOnline

Exception details:
Microsoft.IdentityServer.Web.NoValidStrongAuthenticationMethodException: No strong authentication method found for the request from urn:federation:MicrosoftOnline.
at Microsoft.IdentityServer.Web.Authentication.AuthenticationPolicyEvaluator.EvaluatePolicy(Boolean& isLastStage, AuthenticationStage& currentStage, Boolean& strongAuthRequried)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.GetAuthMethodsFromAuthPolicyRules(PassiveProtocolHandler protocolHandler, ProtocolContext protocolContext)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.GetAuthenticationMethods(PassiveProtocolHandler protocolHandler, ProtocolContext protocolContext)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)

The problem user account doesn’t appear to be any different from others that don’t have any issues logging in.

Does anyone any ideas where I look to resolve this?

Thanks

Russell

Answer 1

This has been open for a year and just helped me so.... my issue/solution was as follows:
Issue: During MFA configuration/testing, ALL users could not access portal.office.com and were getting the strong authentication required error

As LarryAlexander-1838 explained the below command returned additional auths but should not have:
(run PS as admin)
$ThisRPT="{Your RPT}"
(Get-AdfsRelyingPartyTrust -Name $ThisRPT).AdditionalAuthenticationRules

I confirmed via the GUI, I had the right custom access issuance rules and then ran:
Get-AdfsRelyingPartyTrust $ThisRPT | Set-AdfsRelyingPartyTrust -AdditionalAuthenticationRules $null
This blanked out the additional authentication rules attribute and my users were able to access the RP again.

Note this fixed my problem and my not fix yours.