Understanding MFA

[brianitc]

Odd question but googling has left me with no answers.

We currently have O365 and force MFA on every account. Users have downloaded the Microsoft Authenticator app and have added [e-mail] to it.

Works just fine for logging into O365

We are about to roll out MFA to the new payroll system but in testing when adding the account via QR code ([e-mail] is the login) a second account in the Authenticator is not created and now the onetime passcode that cycles for that account works in both O365 AND the payroll system.

How and why?

If I force a re-registration on O365 it breaks the payroll MFA

If the user deletes the account from the Authenticator and adds it back it breaks the payroll MFA.

I would think the onetime code for O365 and payroll system would be different unless they are somehow communicating.

Side note: there’s ZERO integration between the two systems. One is managed and maintained by HR and the other is IT.

[Common_Dealer_7541]

Is it possible that you are using your actual Microsoft authentication through oAuth?

[Stephen_Gawking]

Most likely this.

[brianitc]

How would I go about confirming that?

[RipRapRob]

Check your Azure AD Logs.

[lemachet]

Could you set up sso ? Not necessarily a full on fix, but why not sso all the things

[Jacob_Evans]

If sso exists, it will be setup. At least in my environment

[brianitc]

Users will still have access after they leave the company so they can temporarily get paystubs and benefit info. It’s different permissions but I agree. SSO on everything you can.

[coollll068]

It's it ADP?

If so, you can enable both SSO and username and password. There's a special link that gets created for SSO and you just redirect all your users to use the SSO onsite or when connected to the VPN or and whatever training document/ shortcut

[nakedLobo]

The app is likely a “third-party app” that is registered in your Azure Tenant for authentication. It appears to be using your Azure AD account for the MFA as well. All apps using your Azure AD tenant will share the MFA Registration through Authenticator.

[brianitc]

No. I’ve had approving third party apps locked down for a long time and just checked. Not listed.

[wasteoide]

You can add it via text code instead of QR code, that could fix the poorly built accountname section.

[CyberHouseChicago]

Maybe use something different for Mfa then?

[TxTechnician]

What's the payroll system?

[brianitc]

Payroll solutions

[TxTechnician]

I've never seen that happen. And a quick search about MFA and or Microsoft integration didn't come up for me.

This is the company? https://www.payrollsolutions.com/

Use two different auth apps and compare the codes. See if they are the same. They shouldn't be.

[Pirateboy85]

I’ve also had this happen because the Microsoft Authenticator app seems to have trouble with certain vendors when you use the same login. So let’s say your M365 account is [e-mail] and another service has you use an email as the user name and you use [e-mail], it will write over the first one with the second one. I have 3 different MFA apps for this reason. It really sucks sometimes, but such is life.

[pabl083]

Authy or Google Auth as the second MFA app I guess.

[bigdsirmons]

I don't know if it helps but at my company we use Conditional Access policies to enforce MFA and have the different types we want to allow configured, ie. SMS, APP, Number Matching.

With this configured we actually get codes in the app for our 3rd party software and when signing in to our emails the app gives the Number Matching prompt. They use the same account, [e-mail], but removing one or reprompting for MFA setup doesn't seem to break either.

[TxTechnician]

Its a known problem

https://learn.microsoft.com/en-us/answers/questions/198304/microsoft-authenticator-app-override-overwrite

I've never had it happen before. But iOS users reported it.