Windows Hello for Business is ideal for information workers that have their own designated Windows PC. Microsoft global Azure and Azure Government offer the following three passwordless authentication options that integrate with Azure Active Directory (Azure AD): Windows 10 Device, phone, or security keyĮach organization has different needs when it comes to authentication. Passwordless authentication methods are more convenient because the password is removed and replaced with something you have, plus something you are or something you know. If you turn off this feature, you must manually set the SupportsMfa setting to false for all domains that were automatically federated in Okta with this feature enabled.Features like multifactor authentication (MFA) are a great way to secure your organization, but users often get frustrated with the additional security layer on top of having to remember their passwords.

For the option Okta MFA from Azure AD, ensure that Enable for this application is unchecked and click Save.

From the Okta Admin Console, go to Applications > Applications.

To disable the feature, complete the following steps: Azure AD Conditional Access accepts the Okta MFA claim and allows the user to sign in without requiring them to complete the AD MFA. So although the user isn't prompted for the MFA, Okta sends a successful MFA claim to Azure AD Conditional Access. This happens when the Office 365 sign-on policy excludes certain end users (individuals or groups) from the MFA requirement.

Okta incorrectly sends a successful MFA claim To get out of the resulting infinite loop, the user must re-open the web browser and complete MFA again. If the user completes MFA in Okta but doesn’t immediately access the Office 365 app, Okta doesn’t pass the MFA claim. The user doesn't immediately access Office 365 after MFA.

But again, Azure AD Conditional Access requires MFA and expects Okta to pass the completed MFA claim. If the user is signing in from a network that’s In Zone, they aren't prompted for the MFA. The sign-on policy doesn’t require MFA when the user signs in from an 'In Zone' network but requires MFA when the user signs in from a network that is 'Not in Zone' However, Azure AD Conditional Access requires MFA and expects Okta to pass the completed MFA claim. Neither the org-level nor the app-level sign-on policy requires MFA. Okta sign-on policy is weaker than the Azure AD policy: End users can enter an infinite sign-in loop in the following scenarios:

Ms mfa setup