MSExchangeGuru.com

We have deployed the Microsoft Azure MFA in the customer infrastructure. Everything was working fine. MAC users reported Twice MFA. Let us see how did we fix it.

Azure MFA is working as expected. Users will accept and will agree to follow all the steps if it is a security requirement.

At the same time, twice MFA within few seconds can be annoying and frustrating for the users.

Issue:

Azure MFA is working as expected for the users on windows computers and tablets. MAC users were getting 2 MFA phone, txt or app verification prompts.

Resolution:

-Issue looked little strange so reported this to Microsoft.

-Microsoft recommended checking if there are 2 authentications coming to the Azure MFA.

-Logged in to the Azure MFA server and went to the following path

“C:\Program Files\Multi-Factor Authentication Server\Logs”

-Open the MultiFactorAuthRadiusSvc.log file

-2 login request came as shown below.

2017-02-14T02:57:19.234778Z|0|1412|6452|pfrad|Calling pfAuthUser(‘Domain\pnigam’, ”, 1)
2017-02-14T02:57:24.600871Z|0|1412|6452|pfrad|authResult = 1
2017-02-14T02:57:24.600871Z|0|1412|6452|pfrad|rawCallStatus = 21

-This clarifies that there is no bug or issue, in fact, there are 2 authentication requests are coming.

-Yes, on MAC, there was no direct RDP happening and there is no way to do it. When I continue to stare my MacBook 12″. I was able to see 2 logins were happening.

-For customer and me the issue stands the same, users won’t like to do MFA twice within few second.

-The workaround to avoid the multiple logins in quick time is to add cache entry in the Azure Portal by following the below-mentioned steps from here.

https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-whats-next#caching-in-azure-multi-factor-authentication

• Log on to http://azure.microsoft.com
  
• Navigate to the MFA Management Portal as per this link. https://msexchangeguru.com/2017/01/16/unable-to-download-azuremfa/
  
• Click Caching under the Configure section, in the Azure Multi-Factor Authentication Management Portal.
  
• On the Configure caching page click New Cache
  
• Select the Cache type and the cache seconds. Click create.
  

-After configuring the cache, user was prompted only once.

-Checked the MultiFactorAuthRadiusSvc.log file

2 login were coming but they had different rawCallStatus. First one had rawCallStatus = 21 and Second one had rawCallStatus = 6

2017-02-14T02:57:56.986251Z|0|1412|10088|pfrad|Calling pfAuthUser(‘Domain\pnigam’, ”, 1)
2017-02-14T02:57:57.550306Z|0|1412|10088|pfrad|authResult = 1
2017-02-14T02:57:57.550306Z|0|1412|10088|pfrad|rawCallStatus = 6

-Let me decode the code. The below table tells the code description. 21 is Mobile App Authenticated and 6 is Used Cache. Which was just perfect. This table can be very useful in troubleshooting for the security team.

So, we implemented this workaround but we ensured to add the Authentication Type, Application Name, and IP so that the cache only applies to the same IP.

 

Prabhat Nigam

CTO @ Golden Five

Team@MSExchangeGuru

Posted February 16th, 2017 under MFA. Tags: Azure MFA, MAC Twice MFA
RSS 2.0 feed. Leave a response, or trackback.