Dealing with Azure AD MFA via REST APIs

Question

I am working on an integration solution where in I would be creating users in Azure AD using Graph APIs. Problem is that the customer has enforced MFA and we cannot have any manual intervention as this our integration solution's goal is to automate user creation via a server-server call. Does anybody have a solution to this issue? I could see 3 options for MFA - email, phone (SMS) and microsoft authenticator. The first two are impossible to integrate AFAIK, the last one looks possible but IMHO there is no API for that as well.

My automation performs the following:

1. POST to https://login.microsoftonline.com/organizations/oauth2/v2.0/token with the following details:

Header

x-www-form-urlencoded

Body

client_id xx9x9xxx00xxxxxx scope Directory.ReadWrite.All client_secret sdvds8vdsvsc8sd username [email protected] password $@#%#%#%#%#% grant_type password

Without MFA, everything works perfectly i.e. on another account without MFA (my own account, not the customers).

This is the error I am getting:

{ "error": "invalid_grant", "error_description": "AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '00000003-0000-0000-c000-000000000000'.\r\nTrace ID: a05be65f-5bd7-4db0-9896-5a8907d10a00\r\nCorrelation ID: 34454b92-46da-46b5-8ccf-8f07325ea8ff\r\nTimestamp: 2021-06-16 04:18:43Z", "error_codes": [ 50076 ], "timestamp": "2021-06-16 04:18:43Z", "trace_id": "a05be65f-5bd7-4db0-9896-5a8907d10a00", "correlation_id": "34454b92-46da-46b5-8ccf-8f07325ea8ff", "error_uri": "https://login.microsoftonline.com/error?code=50076", "suberror": "basic_action" }

Can anybody advise any workarounds, solutions or suggestions on how to overcome this?

Answer 1

You are using Azure AD ROPC flow to get the token, you could not use it if the user account is MFA-enabled.

If you want to get the token with the MFA-enabled account, you could use the auth code flow, which is an interactive way. If you want a non-interactive way, you could use the client credential flow, it can get the token without a user account.

Answer 2

Your own account AAD is successfully working as you are the administrator you definitely satisfy the access policy set there in AAD but as for your customer's account their AAD has been set by their administrator and you need to satisfy all the conditions to login into .

Also, in AAD, if you do an initial login in one location, and then login from another location, there are conditions on the AD that flag this as "risky activity".

So for your account there is a "moved to a new location" flag that can get set, automatically triggering the need for MFA. If you do face this, check the conditional access locations in Azure and see if your AAD admin can clear the flag. (Or set up the original account with named locations in place.) .Please find the referred document here.

Another way to resolve this issue can be that users must sign in to the Flow portal under conditions that match the access policy of the service that they are trying to access (such as multi-factor, corporate network, and so on), and then repair or re-create the connection. Please find the referred document here.

Update:

Conditional access policies prevent non-interactive flows to work. This includes Windows Integrated authentication and Resource Owner Password Credential flows.

Possible solutions...

1. Use a interactive flow instead.
2. If you are using a interactive flow and still getting this error, ensure openid is one of the scopes during the interactive sign-in. You might be getting the error after the interactive sign-in and trying to exchange the authorization code for a access token.

https://login.microsoftonline.com/contoso.onmicrosoft.com/oauth2/authorize
?client_id=########-####-####-####-############
&response_type=code
&scope=openid groups.read.all
&nonce=1234
&redirect_uri=https://app.contoso.com

3. Add the client application to the exception list of the Conditional Access Policy
4. Add the user to the exception list of the Conditional Access Policy
5. If not using conditional access policies and the user is directly enabled for MFA, then as a last resort, disable MFA for the user if solutions above (specifically solution #1 and #2) do not work for you.