Azure Active Directory

Welcome to the Azure Active Directory suggestions and feedback site! We love hearing from you. If you have suggestions, please submit an idea or vote up an idea. We are monitoring the site actively.

Thank you for joining our community and helping improve Azure AD!

Wehave a new log in experience integrated with Azure AD, and we stronglyrecommend you log in with your Azure AD (Office 365) account. If yourUserVoice account is the same email address as your Azure AD account, yourprevious activities will be automatically mapped to your Azure AD account.  You can read more here for details: https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Putting-customers-first-for-f...

  • Hot ideas
  • Top ideas
  • New ideas
  • My feedback
  1. Add application name (and/or IP) to MFA prompt

    Hi,

    Currently the MFA prompt on the mobile device is very limited in the amount of information being shown. My users are getting prompts sometimes out of the blue, and they don't if those are legitemate or fraudulent.

    Legitemate prompts that are asynchronous from users:
    - Outlook on some computer needing to provide MFA again after X days
    - Outlook on mobile needing to provide MFA again

    Fraudulent:
    - Somebodies password was phished.

    The idea is to add some more context information to the MFA prompt in the authenticator app:


    • Application name requesting MFA, or

    • IP Address / geolocation, or
    11 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Multi-factor Authentication  ·  Flag idea as inappropriate…  ·  Admin →
  2. provide a way to import OATH tokens into Azure MFA, assign them to users, and autoactivate them, in order to allow migration

    Need a way to import OATH tokens, assign them to users, and have them activated automatically, in order to allow migration from an existing system using the OATH tokens without having to manually activate each one individually.

    11 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Multi-factor Authentication  ·  Flag idea as inappropriate…  ·  Admin →
  3. mfa nps extension for rds bypass wan ip

    It would be great to bypass MFA for RDS to given WAN IP adresses. So the users can login directly only from the office.

    11 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Multi-factor Authentication  ·  Flag idea as inappropriate…  ·  Admin →
  4. Management Portal 2 factor authentication

    Yes there is a way to enable 2 factor authentication for apps and hosted services etc, but if there is a way to enable it for the management portal I cannot find it.

    This is the same request, it's marked as completed by the Azure team, but the link they provide is for enabling it within hosted services and on prem servers, and doesn't actually appear to address the question.
    http://feedback.azure.com/forums/223579-azure-preview-portal/suggestions/3043211-two-factor-or-ad-authentication-for-management-p

    11 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    under review  ·  3 comments  ·  Multi-factor Authentication  ·  Flag idea as inappropriate…  ·  Admin →
  5. provide a way to sync the mfa codes between iOS and android.

    I'd like to sync between iOS an android devices. please add backup/sync feature

    10 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Multi-factor Authentication  ·  Flag idea as inappropriate…  ·  Admin →
  6. Azure AD - Conditional Access Policy - On-Premise MFA Server

    Azure AD should allow for redirect via a conditional access rule to On-Premise MFA Server and not just the cloud version of MFA. You can create a conditional access rule to redirect to other 3rd party MFA solutions such as DUO, but not you own Microsoft On-Premise MFA solution. This will allow for companies to leverage their on-premise MFA server to which may already have a large technology investment.

    10 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Multi-factor Authentication  ·  Flag idea as inappropriate…  ·  Admin →
  7. MFA only allow initial setup from inside corporate network.

    Please allow configuration of initial MFA setup for users so that they can only do initial setup of their MFA from within our corporate network. Also the ability to pre-provision and lock-down their MFA settings (cell phones etc). We need to be able to make sure that not just anyone from outside can do the initial provisioning of a users MFA setup. In case a users password is compromised.

    10 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Multi-factor Authentication  ·  Flag idea as inappropriate…  ·  Admin →
  8. Give option not to use trusted device as the MFA source

    We have noticed you don't get prompted for MFA, even if you have, "Require multi-factor authentication", "All Locations" and "Browser" ticked in Azure.

    I've been told by Microsoft Support that this is because the device I'm logging in from is a, "Trusted Device" (It is a Windows 10 laptop with, "Access work or school" in Accounts configured).

    You get prompted for full MFA if using Google Chrome, but if you are using Edge or IE then this is bypassed because the laptop fulfils the MFA request.

    In Conditional Access policy, "Require multi-factor authentication" is defined as, "User must complete additional…

    9 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Multi-factor Authentication  ·  Flag idea as inappropriate…  ·  Admin →
  9. There should be an option to disable Office Phone as a verification option

    On the MFA settings portal, there is no way to separate office phone from cell phone when choosing the verification options that will be presented to users. The only option is "Phone call". However, when users go into the verification options on their user profile, they can choose to do MFA via "Office phone" or "Mobile phone".

    There needs to be a way to disable Office Phone as an option so that users cannot select it. It is not secure as a verification option.

    9 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    2 comments  ·  Multi-factor Authentication  ·  Flag idea as inappropriate…  ·  Admin →
  10. Beter whitelist controls for MFA NPS Extention

    https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension-advanced

    IP_WHITELIST only allows for single IP addresses. Would be very usefull to provide CIDR ranges.

    Would also be nice to have to specify for wich IP address MFA should be triggered. So by default no MFA, only when the authenticating device matches criteria (e.g. IP address, etc.) Would be great if that was integrated in de NPS configuration.

    9 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Multi-factor Authentication  ·  Flag idea as inappropriate…  ·  Admin →
  11. Allow multiple tenants connect to the same Azure MFA NPS extension or on-premise installed MFA server

    Right now it is only possible to connect the Azure MFA NPS extension to one Azure Tenant ID. For hosters it would be great to use a central NPS/Radius server or MFA servers where all the customers can connect to. Sll with their own tenant ID.

    9 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    3 comments  ·  Multi-factor Authentication  ·  Flag idea as inappropriate…  ·  Admin →
  12. Different authentications options for MFA roles

    Currently you have one one service-wide setting of MFA authentication options. It would be very useful to have different MFA settings for different user/usage roles, e.g. have phone, mobile app and OTP for general users but only app and OTP for high risk users.

    Background is, that some compliance frameworks (PCI DSS, NIST etc.) recommend not to use phone calls or SMS, but that some real life scenarios require just that - either for technical reasons or for ease of use (aka user acceptance). So for some user groups it may be OK or even necessary to use phone calls…

    9 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Multi-factor Authentication  ·  Flag idea as inappropriate…  ·  Admin →
  13. precedence and priority for conditional access controls. When compliance, MFA, and Hybrid Azure AD join are all checked

    Hello All,
    One of my questions, that I’ve never been able to get answered, it’s not in the Microsoft documentation, is the question of precedence and priority for conditional access controls. When compliance, MFA, and Hybrid Azure AD join are all checked – how does Intune determine which one is to be applied? If MFA is checked, will it always be presented to the user, or will it not be used when a device is compliant? What logic is used? Sadly the documentation is lacking for this.

    9 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Multi-factor Authentication  ·  Flag idea as inappropriate…  ·  Admin →
  14. Azure MFA Server Add AD user logins for their domain account

    Why wasn't user domain logins one of the first things added to Azure MFA Server? That makes the most sense. I mean seriously. I understand application 2FA but user login without 2FA is an even higher security risk.

    9 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Multi-factor Authentication  ·  Flag idea as inappropriate…  ·  Admin →
  15. One of the things I miss is RADIUS support which can authenticate against Azure AD.

    Azure MFA with RADIUS extension requires big setup. Azure has everything except RADIUS support. I
    I ended up using foxpass. That would be a nice addition.

    9 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Multi-factor Authentication  ·  Flag idea as inappropriate…  ·  Admin →
  16. Use Cortana's voice for Azure MFA phone verification/callback service

    Azure MFA already has support for custom voice messages [1].

    To provide a consistent experience across all Windows 10 devices, it would be neat if the Azure MFA callback service had Cortana's voice.

    This would also allow Azure MFA to benefit from the Cortana accent regionalisation efforts (American English for en-us, Australian English for en-au).

    [1] https://azure.microsoft.com/en-us/documentation/articles/multi-factor-authentication-whats-next/#custom-voice-messages

    9 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Multi-factor Authentication  ·  Flag idea as inappropriate…  ·  Admin →
  17. provide a radius service for azure active directory so vpn clients can use azure mfa

    provide a radius service for azure active directory so vpn clients can use azure mfa

    8 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Multi-factor Authentication  ·  Flag idea as inappropriate…  ·  Admin →
  18. Converged MFA and SSPR

    We have enable the converged Multi-factor Authentication (MFA) and Self-Service Password reset (SSPR). I feel this is easier for end users to update their info as it is all in one place. However, There should be some indication on each type of authentication/security option for what is can be used for (SSPR OR MFA or Both). This would help non-technical end users understand the configuration better.

    8 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Multi-factor Authentication  ·  Flag idea as inappropriate…  ·  Admin →
  19. Preserve MFA enrollment settings when changing from User State mode to Conditional Access

    We enrolled MFA a long time ago when the standard enrollment type was user state mode, we got 3000 users enrolled. Now we are considering to change from User state mode to Conditional Access mode, but we have identified a major blocker in this change.
    To use CA we need to set the User State to MFA disabled, and activate the CA policy, but when the CA policy enforce the user to use MFA the user need to enroll in MFA again! I really don't understand why you have implemented it in this way, we need to have the possibility…

    8 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Multi-factor Authentication  ·  Flag idea as inappropriate…  ·  Admin →
  20. Add MFA support for server login including console mode (not RDP)

    I see many companies are using third-party MFA solutions to secure their servers.
    These solutions have 3rd party add-on that modify the GINA.dll so the server login screen will have additional field for OTP or will have a wait mechanism for push notifications. The add-on applies for both RDP and direct (console) connections without the need for RDG, and works on servers 2008 R2 to 2016.

    Azure AD MFA should also be able to:
    1. Leverage GINA.dll (it is MS code)
    2. Be able to pass requests to and from MFA Server or NPS Server
    3. It should be agent-less…

    8 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Multi-factor Authentication  ·  Flag idea as inappropriate…  ·  Admin →
  • Don't see your idea?

Feedback and Knowledge Base