Azure MFA with phishing resistant authentication

[irp]

We are struggling to get Azure MFA set up.  We purchased the license that permits that. That is the only reason we bought that license. We use phishing resistant MFA such as FIDO key and Windows Hello.  Microsoft has been releasing conditional access rules for "require phishing resistant MFA for admins" and those rules will be set up for all at the end of Dec.  All our admins only have FIDO keys - no passwords,

We have set SSO up with Adobe, AutoDesk, Trimble, AFI.AI and another ERP I will not name. But, GoTo does not work. The messages we get are

Sorry, but we’re having trouble signing you in.

AADSTS75011: Authentication method 'X509, MultiFactor' by which the user authenticated with the service doesn't match requested authentication method 'Password, ProtectedTransport'. Contact the GoToMyPC application owner.

Or

AADSTS75011: Authentication method 'MultiFactor, Fido' by which the user authenticated with the service doesn't match requested authentication method 'Password, ProtectedTransport'. Contact the GoToMyPC application owner

This implies that 1. GoTo is not really supporting all of Azure's authentication. and 2. GoTo probably is  not using phishing-resistant MFA internally in their own org.

Adversary in the middle attacks are what 99% of phishing attacks are these days, so we need to protect ourselves, especially the admin accounts, using phishing resistant MFA.  

I have tried explaining this to support and I get "we support Azure MFA" as an answer.  It probably should be "we support phishing-susceptible MFA but not phishing-resistant Azure MFA."

[GlennD]

Hi @irp, welcome to the community.

We are looking into this and seeing if we can recreate the issue you describe. We will post an update once we have some results.

[AbhishekYadav]

Hey @irp,
We're actively working to implement and support this feature as soon as possible. Anticipate receiving an update on its progress later this week.

[AbhishekYadav]

Hey @irp ,

We have released application change to facilitate FIDO2 authentication, allowing you to perform web logins using this method.

Please note that for initial installations, it's advisable to temporarily enable the MFA option during registration, as the desktop app registration flow currently does not support the security key flow. Rest assured, we have plans to release a fix soon to support security key registration for the desktop application.

[irp]

Thank you. I think we have it mostly working now.  I am struggling a bit with how to install the agent as the agent install is wants a user name/password.   I shut off SSO to install the agent, then turned it back on. 

[AbhishekYadav]

Thank You for your comment, harrybrook52039. 

You may need to turn off SSO for the host registration flow since it's currently not supported for a few more weeks. Please note that we plan to address this constraint early next year. Stay tuned for updates, and until then, kindly bear with us.