Actionable Message cards received "MFA Required" when we try to post back to our web site

Please note that our forum is a public platform, and we will modify your question to hide your personal information in the description. Kindly ensure that you hide any personal or organizational information the next time you post an error or other details to protect personal data.

Hi John Paglierani

Thank you for reaching out to Microsoft Q&A forum

Based on your description, I think this behavior may come from the Conditional Access policy or Security Defaults are likely enforcing MFA on non-interactive sign-ins. Actionable Message cards use a background token (via Exchange/Outlook) to POST your response. If a policy requires MFA for that token exchange, the call will fail because no interactive prompt can occur.

This explain while in staging, you probably had no such policy or more relaxed settings, which is why it worked there.

In this situation, there are some initial things you can apply first to see if you can solve the problem:

1/ Check Azure AD Sign-In Logs:

Identify which policy triggered the MFA requirement. The sign-in log (under Non-interactive category) will show the specific Conditional Access policy or if Security Defaults was applied.

Link instructions: https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins#non-interactive-user-sign-ins

2/ Use Conditional Access "What If" tool:

In Azure AD Conditional Access, use the “What If” tool to simulate the user’s sign-in to Exchange Online. This helps confirm which policies are applying MFA.

You can read here for more information: https://learn.microsoft.com/en-us/entra/identity/conditional-access/what-if-tool

3/ Adjust Conditional Access Policies:

Modify your policy so that it doesn’t require MFA for the actionable message scenario. For example, exclude “Exchange Online” (or the specific accounts) from the MFA-required policy.

In the meantime, you can review MFA Settings by verify Security Defaults (Azure AD > Properties) – if enabled, consider disabling it and using custom policies. Also check this LINK to ensure test accounts are not enforced for MFA outside of Conditional Access.

Additionally, I have found this thread may have the necessary information to provide more insight about this concern: https://learn.microsoft.com/en-us/answers/questions/1185637/seeing-login-failures-with-non-interactive-sign-in

Hope my answer will help you, for any further concern, kindly let me know in the comment section.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".     

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

To diagnose the "MFA Required" issue when posting back to your web server from the Actionable Message card in your production environment, consider the following steps:

1. Review Conditional Access Policies: Ensure that the Conditional Access policies applied in your production environment are consistent with those in your staging environment. Sometimes, specific conditions or user groups may trigger MFA unexpectedly.
2. Check User Authentication Settings: Verify the authentication settings for the users involved in the production environment. Even if MFA has been removed for testing accounts, other settings might still enforce MFA based on risk or location.
3. Audit Logs: Utilize Azure AD sign-in logs and audit logs to gather more information about the authentication attempts. These logs can provide insights into why MFA is being triggered.
4. Test Different User Accounts: If possible, test with different user accounts that have varying permissions and settings to see if the issue persists across all accounts or is isolated to specific ones.
5. Network and Security Settings: Ensure that there are no additional network or security settings in the production environment that could be influencing the authentication process differently than in staging.
6. Consult Documentation: Refer to Microsoft documentation regarding Azure Multi-Factor Authentication and Conditional Access to ensure that all configurations are correctly set up.

If these steps do not resolve the issue, consider reaching out to Microsoft support for further assistance.

References:

• Troubleshoot Azure Multi-Factor Authentication issues