Azure MFA with phishing resistant authentication
We are struggling to get Azure MFA set up. We purchased the license that permits that. That is the only reason we bought that license. We use phishing resistant MFA such as FIDO key and Windows Hello. Microsoft has been releasing conditional access rules for "require phishing resistant MFA for admins" and those rules will be set up for all at the end of Dec. All our admins only have FIDO keys - no passwords,
We have set SSO up with Adobe, AutoDesk, Trimble, AFI.AI and another ERP I will not name. But, GoTo does not work. The messages we get are
Sorry, but we’re having trouble signing you in.
AADSTS75011: Authentication method 'X509, MultiFactor' by which the user authenticated with the service doesn't match requested authentication method 'Password, ProtectedTransport'. Contact the GoToMyPC application owner.
Or
AADSTS75011: Authentication method 'MultiFactor, Fido' by which the user authenticated with the service doesn't match requested authentication method 'Password, ProtectedTransport'. Contact the GoToMyPC application owner
This implies that 1. GoTo is not really supporting all of Azure's authentication. and 2. GoTo probably is not using phishing-resistant MFA internally in their own org.
Adversary in the middle attacks are what 99% of phishing attacks are these days, so we need to protect ourselves, especially the admin accounts, using phishing resistant MFA.
I have tried explaining this to support and I get "we support Azure MFA" as an answer. It probably should be "we support phishing-susceptible MFA but not phishing-resistant Azure MFA."
