Search code examples
azuremicrosoft-graph-apiazure-ad-graph-apimulti-factor-authentication

Azure Graph API Trigger 2FA/MFA Auth Request

Using Azure Graph API how do I trigger a 2FA push?

For example, Duo has an API /auth/v2/auth which triggers a push/SMS/phone call/passcode request to a user. https://duo.com/docs/authapi#/auth

Twilio supports this via their "Verify v2" endpoint https://verify.twilio.com/v2/Services/{ServiceSid}/Verifications https://www.twilio.com/docs/verify/api/verification

Where is Microsofts?

Solution

  • Note that: MFA is a part of the user journey, and it cannot be triggered, it can only be enabled. Refer this Microsoft Q&A by Jai Verma. MFA is triggered every time when user logs in and if the Azure AD user has MFA enabled

    • Only when a user tries to access an application configured to trigger MFA, MFA be triggered.
    • Or if the user is enabled MFA.
    • MFA cannot be triggered from Azure AD side remotely.

    You can enable MFA either by Azure Portal, PowerShell or Conditional Policy.

    For sample, using PowerShell you can enable MFA:

    $mf= New-Object -TypeName Microsoft.Online.Administration.StrongAuthenticationRequirement
$mf.RelyingParty = "*"
$mfa = @($mf)

Set-MsolUser -UserPrincipalName "[email protected]" -StrongAuthenticationRequirements $mfa

    enter image description here

    When I tried to login with the user, got MFA prompt:

    enter image description here

    References:

    Trigger/Invoke MFA request for specific user via PowerShell or other tool? - Microsoft Community Hub by ChrisAyers

    Rest API to enable MFA - Microsoft Q&A by AmanpreetSingh-MSFT