Skip to content

Commit

Permalink
Merge pull request #613 from v-emilypr/patch-1
Browse files Browse the repository at this point in the history
Policheck update for geopolitical term
  • Loading branch information
localden authored Dec 12, 2024
2 parents 86ad90e + f3a5865 commit 86bc156
Showing 1 changed file with 1 addition and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ If your desktop or mobile application runs on Windows and on a machine connected
- Does not work for MSA users. For MSA uses try out [WAM](./wam.md)
- IWA is for applications written for .NET and .NET Framework.
- IWA does NOT bypass MFA (multi factor authentication). If MFA is configured, IWA might fail if an MFA challenge is required, because MFA requires user interaction.
> This one is tricky. IWA is non-interactive, but 2FA requires user interactivity. You do not control when the identity provider requests 2FA to be performed, the tenant admin does. From our observations, 2FA is required when you login from a different country, when not connected via VPN to a corporate network, and sometimes even when connected via VPN. Don’t expect a deterministic set of rules, Microsoft Entra ID uses AI to continuously learn if 2FA is required. You should fallback to a [user prompt](./acquiring-tokens-interactively.md) if IWA fails
> This one is tricky. IWA is non-interactive, but 2FA requires user interactivity. You do not control when the identity provider requests 2FA to be performed, the tenant admin does. From our observations, 2FA is required when you login from a different country or region, when not connected via VPN to a corporate network, and sometimes even when connected via VPN. Don’t expect a deterministic set of rules, Microsoft Entra ID uses AI to continuously learn if 2FA is required. You should fallback to a [user prompt](./acquiring-tokens-interactively.md) if IWA fails
- The authority passed in the `PublicClientApplicationBuilder` needs to be:
- tenanted (of the form `https://login.microsoftonline.com/{tenant}/` where `tenant` is either the guid representing the tenant ID or a domain associated with the tenant.
Expand Down

0 comments on commit 86bc156

Please sign in to comment.