Forum Discussion

irp's avatar
irp
New Contributor
2 years ago

Azure MFA with phishing resistant authentication

We are struggling to get Azure MFA set up.  We purchased the license that permits that. That is the only reason we bought that license. We use phishing resistant MFA such as FIDO key and Windows Hello.  Microsoft has been releasing conditional access rules for "require phishing resistant MFA for admins" and those rules will be set up for all at the end of Dec.  All our admins only have FIDO keys - no passwords,

 

We have set SSO up with Adobe, AutoDesk, Trimble, AFI.AI and another ERP I will not name. But, GoTo does not work. The messages we get are

Sorry, but we’re having trouble signing you in.

AADSTS75011: Authentication method 'X509, MultiFactor' by which the user authenticated with the service doesn't match requested authentication method 'Password, ProtectedTransport'. Contact the GoToMyPC application owner.

 

Or

AADSTS75011: Authentication method 'MultiFactor, Fido' by which the user authenticated with the service doesn't match requested authentication method 'Password, ProtectedTransport'. Contact the GoToMyPC application owner

 

This implies that 1. GoTo is not really supporting all of Azure's authentication. and 2. GoTo probably is  not using phishing-resistant MFA internally in their own org.

 

Adversary in the middle attacks are what 99% of phishing attacks are these days, so we need to protect ourselves, especially the admin accounts, using phishing resistant MFA.  

 

I have tried explaining this to support and I get "we support Azure MFA" as an answer.  It probably should be "we support phishing-susceptible MFA but not phishing-resistant Azure MFA."

 

5 Replies

  • AbhishekYadav's avatar
    AbhishekYadav
    GoTo Moderator
    2 years ago

    Thank You for your comment, harrybrook52039. 

     

    You may need to turn off SSO for the host registration flow since it's currently not supported for a few more weeks. Please note that we plan to address this constraint early next year. Stay tuned for updates, and until then, kindly bear with us.

  • irp's avatar
    irp
    New Contributor
    2 years ago

    Thank you. I think we have it mostly working now.  I am struggling a bit with how to install the agent as the agent install is wants a user name/password.   I shut off SSO to install the agent, then turned it back on. 

     

  • AbhishekYadav's avatar
    AbhishekYadav
    GoTo Moderator
    2 years ago

    Hey irp ,

    We have released application change to facilitate FIDO2 authentication, allowing you to perform web logins using this method.

    Please note that for initial installations, it's advisable to temporarily enable the MFA option during registration, as the desktop app registration flow currently does not support the security key flow. Rest assured, we have plans to release a fix soon to support security key registration for the desktop application.

     

     

  • AbhishekYadav's avatar
    AbhishekYadav
    GoTo Moderator
    2 years ago
    Hey irp,
    We're actively working to implement and support this feature as soon as possible. Anticipate receiving an update on its progress later this week.
  • GlennD's avatar
    GlennD
    GoTo Manager
    2 years ago

    Hi irp, welcome to the community.

     

    We are looking into this and seeing if we can recreate the issue you describe. We will post an update once we have some results.