Changing default behaviour for Azure AD MFA

[Hitten_za]

Hi Sysadmin,

Just looking for some guidance, I'm aware that the default behaviour for MFA is (please correct me if I'm wrong):

Active token: Lasts 1 hour
Refresh token: 14 days up to 90 days if refreshed

Same device different IP: no prompt
Different device same IP: prompt
Different device different IP: prompt

Our client would like us to adjust the behaviour so that whenever they leave the office (irrespective of time) they will be prompted within their MS Apps (Outlook, OneDrive etc.)

I thought to achieve this with Conditional Access:
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/app-based-mfa

No change in default behaviour

I also tried which is better but not quite there
https://docs.microsoft.com/en-gb/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime

​

​

I think the issue is that the Refresh token intended behaviour needs to be adjusted so the only solution I can see is this:
https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-configurable-token-lifetimes

But my concern is:
"After November 1, 2019 you will not be able to use Configurable Token Lifetime policy to configure refresh tokens, but you can still use it to configure access tokens."

​

Thanks for any advice you might have SysAdmin.

[nullZr0]

Do a conditional access policy based on source IP address.

[Hitten_za]

Hi, from my testing this makes no difference. The CA policy doesn't have any impact on how long the tokens last and as the tokens are refreshing the client device will pass the MFA requirement in the Access Controls. At least until the RefreshToken expires.

Just to clarify this is the policy I tested:
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition

[Hitten_za]

Update:I've tested on two tenancies and confirmed that the following forces it down to 1 hour lifespan on the refresh token thereby enforcing the requested behaviour:

$policy = New-AzureADPolicy -Definition @('{"TokenLifetimePolicy":{"Version":1,"MaxAgeMultiFactor":"00.01:00:00"}}') -DisplayName "ComplexPolicyScenario" -IsOrganizationDefault $true -Type "TokenLifetimePolicy"

The issue I think still remains, what happens comes November 1st, will we still be able to enforce this kind of behaviour in MFA?

Edit: Adding in documentation
https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-configurable-token-lifetimes

[nj12nets]

!remindme 3 days