(Azure AD) MFA - Conditional Access : Additional Verification Options Missing In AD Sign In Event

Question

Deployed a MFA conditional access policy through Azure AD. The policy I deployed is only providing (1) sign-in option for the user I'm testing this policy with and is failing to provide alternative sign-in verification methods (SMS, OTP, etc.) during the sign-in event. Confirmed the remember trusted device portion of the condition of the policy is applying correctly which has been set for 90 days.

Screenshots attached of expected results v. actual results.

Expected results

Actual results

User Level:

• Account is MFA compatible
• Within conditional policy scope
• Has multiple verification methods assigned (Authenticator, Email + Phone) - currently only defaults to primary.

Conditional Access Policy Level -Access control: Require Authentication strength enabled w Auth method to check for . -Attempted "Require multifactor authentication" option under policy - results in the same.

Multifactor Authencation Service settings

• Verification options have been enabled
• Remember trusted device enabled and applying to Conditional Access policy (90 days)
• Screenshot below for reference. 'test' under trusted IP put for privacy and not applied to policy

Azure AD Tenant Settings

• Tenant security default settings are disabled

Auth Strength Method

Conditional Policy linked to Auth Strength

MFA Global Settings - 'test'

Answer 1

The "Sign in another way" link is only hidden from the UX if only one proof is returned from the Evolved Security Token Service (eSTS) server.

You mention that the user has Authenticator, Email, and Phone set up as additional verification options. According to the documentation, the email address option is only used for SSPR, so that could definitely be part of the issue since it would not count as a secondary form of authentication in this scenario. Also, according to that same documentation, voice call can only be set up as secondary authentication and not primary. From the guide:

If the user has additional verification options set other than the Email option and this still is not working, it would be helpful to see a screenshot of your configuration to verify whether this is an unknown bug or an issue with the setup.