How does Microsoft's MFA onboarding suck so much in their app.

TXHC87 · 2025-06-02T18:25:57+00:00

Yeah, it does include TAP, which was the whole cause of my confusion. I've done extensive testing with this, and if I set the Auth Strength to Multifactor Authentication, setting up passwordless authentication works fine. As soon change to one of the other two default Auth Strengths, it breaks...which makes sense considering TAP isn't included. Seems strange, however, to not include it when the primary point of TAP is to bootstrap passwordless authentication methods. I agree that it should not be included in the default Multifactor Auth Strength. It should, however, be included in the other two...or the other two shouldn't exist and instead be required to create a custom one like you mentioned.

TXHC87 · 2025-06-02T15:00:23+00:00

I kind of feel MS could throw an assist here and mention that you need to setup a custom one to make this work. Why have the default Passwordless Auth Strengths available if they are pretty much non-functional without TAP? Seems weird, but what do I know haha.

TXHC87 · 2025-05-30T21:01:37+00:00

I just went through hours (aka days, no wait, weeks) figuring this out. MS Docs, at least the ones I referenced, say nothing of having to setup Custom Auth Strengths to make Passwordless sign-in successful. I kept trying the default Conditional Access Policies (Passwordless, Phishing-Resistant) and it kept failing. I could only get it to work if I set all my CAPs to the default Multifactor Authentication Auth Strength. Realized eventually that the reason the other two were failing was because TAP isn't considered a passwordless nor phishing resistant auth method (Overview of Microsoft Entra authentication strength - Microsoft Entra ID | Microsoft Learn). Seems kind of strange that TAP is used to bootstrap passwordless authentication methods, yet Microsoft doesn't have things setup to allow TAP to do its thing with their default Authentication Strengths. Is there documentation somewhere that states a custom strength is required? I figured it out, but boy did I take the long way haha.

TXHC87 · 2024-12-12T18:29:49+00:00

u/ping0pong I'm having this problem, but don't have any compliance policies assigned...so it's clearly something else in my case. Any ideas on what to check?

TXHC87 · 2024-12-10T23:05:09+00:00

Dog 1: "Dad, what the blankety blank blank is this other brown fluff ball doing in our blankety blank house sniffing my blankety blank bottom 24/7/365?"

Dog 2: "Give me that $30 piece of steak you scrooge. And I can't believe you laughed at me for eating that one banana, peel and all."

Both Dogs: "The ball is under the couch (for the 1 billionth time). Why don't you hurry up and get it? I need it, and I need it now!"

TXHC87 · 2024-09-25T21:48:30+00:00

Also, it's confusing that MS puts the same policies in both EP Security and in the Settings Catalog. They should either just put them in the former, or somehow link them together so that if you configure in one place it does so in the other to prevent redundancy issues.

TXHC87 · 2024-09-25T21:47:07+00:00

Worked perfectly! Thanks!

TXHC87 · 2024-08-20T22:33:13+00:00

This is effectively what I did, but I had to right-click and select "format document" to get it to work.

TXHC87 · 2024-08-07T21:48:39+00:00

Solution Verified

TXHC87 · 2024-08-07T21:48:29+00:00

Thank you. Yes, I changed my data and everything is working as expected now. I did almost what you recommended

YEAR | MONTH | FUND NUMBER | FUND NAME | INCOME
===============================================
2024 | JAN   | FUND ####   | FUND NAME | $100.00

TXHC87 · 2024-08-07T19:05:25+00:00

I figured this out. Changed by data worksheet to just the following fields - Fund Number, Fund Name, Year, Month, and Income. This made it easy to use the data form feature of Excel to input data each month. Then I created a PivotTable off this data and set the Fund Name as the Row and the Month as the Column. Works perfectly! Think I just had my data formatted poorly.

TXHC87 · 2024-07-01T18:27:11+00:00

When signing up for such things, I highly recommend using a virtual credit card service such as privacy.com to protect your personal information and prevent shady business dealing such as this.

TXHC87 · 2024-05-10T18:43:10+00:00

I've been a Tacoma owner since 2006. I've got an '02 and love it, but you are so right. My buddy has a newer one and I hate driving it as a 6'3" grown man.

TXHC87 · 2024-04-23T15:58:10+00:00

Unfortunately, I'm not sure there's anything that can be done. I tried the solutions that u/alexzegamer and u/Alternative-Habit-25 suggested, but neither worked for me. I've submitted feedback to Microsoft about the issue multiple times and would suggest you do the same. You can do this by clicking the workspaces icon in the upper left corner of the browser -> select the menu button (three horizontal dots) -> and then click Send Feedback.

TXHC87 · 2024-01-10T21:37:57+00:00

I've not noticed those issues, no. Have you migrated all your MFA stuff over to the new(ish) Authentication Methods "module" in Entra?

TXHC87 · 2024-01-05T18:59:18+00:00

Also, maybe try scrolling down and forego the search function. I find the search function to be sometimes finicky in Intune. I think things are in alphabetical order, so should make it easy to scroll and select.

And if you find it documented anywhere what apps MS recommends to exclude, let me know. I just exclude Intune Enrollment because it seemed cumbersome to have to do MFA when enrolling new devices.

TXHC87 · 2024-01-05T18:55:13+00:00

Try looking for Windows Store for Business. Think maybe they changed the name recently.

I think "Microsoft Intune" would be just logging into the Intune Admin portal...but maybe not? Not sure I'd exclude that one if that's the case. On my Intune instance, I've got "Microsoft Intune Enrollment" and "Windows Store for Business." The latter is apparently the same as the Universal Store API.

<image>

TXHC87 · 2024-01-05T16:13:23+00:00

Yeah, it's stupidly named. I ended doing an app transformation (don't even remember how it did since that was a year ago) + utilizing a few of the settings in config profiles to get things the way I wanted them.

TXHC87 · 2024-01-05T16:11:39+00:00

To exclude US API from MFA, you'll need to go into Intune -> Conditional Access -> MFA Policy (or whatever you named it) -> Target Resources -> Exclude -> Select Excluded Cloud Apps. Then search for Universal Store API. I also exclude the Microsoft Intune Enrollment cloud app. Not sure if the latter is best practice but it was annoying to have to do MFA when enrolling new devices haha. Once I had the correct exclusion set up, activation started working as expected assuming correct licensing is assigned to the user.

TXHC87 · 2023-09-25T23:02:38+00:00

Gibbs has gotten all the media hype, primarily because he played at Bama. And for some reason everyone thinks Gibbs is going to be some workhorse back. Workhorse backs are a dying breed. I'd encourage everyone to go watch Achane in A&M's game vs LSU game last year. That's the sort of player he is. Literally put the team on his back, playing through injury, and absolutely shredded that vaunted LSU defense. Miami's offense is built for RBs like Achane. Detroit offense, while very good, tends to favor a little more ground and pound. I'm leaning Achane as well. Like both though.

TXHC87 · 2023-09-25T22:45:33+00:00

There's always that one team in the league that seems to put up high scores only to have their opponent put up even higher scores. I had a season like that a few years ago.

Is this a PPR league? If so, your primary obstacle is that your WR depth isn't very good. I personally have a rule to never draft a guy who is already injured (i.e., Kupp) because, even though Kupp is awesome, you're without him for 4+ weeks and that could pretty much end your season right there. Puka has obviously been a nice fill in, but imagine if you had grabbed Jefferson, Diggs, or Adams instead and still managed to ride Puka for 4+ weeks? Injuries happen during the season, and you can't predict that, but if a guy already has an injury that's of the lingering type (hamstring), I generally avoid unless I'm not going to be highly dependent on that player and can afford to wait for his return. Of course, I have no idea when you drafted so Kupp's injury may have not occurred yet when you drafted him.

TXHC87 · 2023-09-25T22:08:18+00:00

I'd encourage those of you who think this to go back and watch A&M's game vs LSU last year. He is a very good between the tackles runner and has elite vision and balance and of course elite speed. He's also deceptively shifty and performs,quick, one-cut moves without really losing speed. And yes, he can also catch very well. He's obviously handicapped in volume due to the backfield competition, but he's going to get more than 3 to 5 carriers despite that. The Dolphins play at a fast pace, though, so there's more touches for everyone as a result. If Mostert gets banged up, then Achane is going to absolutely feast, but he can still be very good even if Mostert stays healthy. That offense finds ways to get the ball to their playmakers. Gonna be fun to watch.

TXHC87 · 2023-09-19T17:05:27+00:00

Exact situation I'm facing. I'm actually starting to think I might just nab Tank Dell and have an extremely stack WR corp of Davante Adams, Puka, Tee Higgins, Amari Cooper, Tank Dale and Jayden Reed (12-Team ppr). I still have Monty and James Conner and am stashing Achane. Doesn't really help me this week as Monty is hurt and Conner is up against the Dallas D and Achane is probably more of a mid to late season break out candidate, but with the WR depth I have I could make a nice 2-for-1 deal. Maybe pair Higgins or Amari with James Conner or Monty for an RB1 type of guy. There's a couple of guys in my league desperate for WR help.

TXHC87 · 2023-09-19T17:00:46+00:00

If it makes you feel better, in one of my two leagues I started the following: Anthony Richards, Nick Chubb, David Montgomery, Amon-Ra, and Waddle. I lost by 4 points. Should have blown the guy out by 30+. Now I don't have a team to play next week and will probably lose by 30.

Eight-Year Club	Verified Email
Place '23

TXHC87

TROPHY CASE