Skip to content

Update auth strengths known issues to include conflict with security … #1950

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
andrequeda wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Update auth strengths known issues to include conflict with security … #1950

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0bac453
Update auth strengths known issues to include conflict with security …
andrequeda Apr 20, 2026
d5eff21
second update to auth strengths known issues to reference registratio…
andrequeda Apr 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions docs/identity/authentication/concept-authentication-strengths.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,9 @@ Conditional Access administrators can also create custom authentication strength

When the user unlocks their Windows device by using Windows Hello for Business, they can access the resource again. Yesterday's sign-in satisfies the authentication strength requirement, and today's device unlock satisfies the sign-in frequency requirement.

- **Authentication strength and registration of security info**: Registering security info requires an MFA session no older than 10 minutes, leading to an interactive request for MFA if such requirement isn't met. This can lead users to choose an MFA method that, when combined with the first factor authentication method previously used, doesn't satisfy the enforced authentication strength, resulting in the error *"Let’s try something else. Another sign-in method is required to access this resource. Close your browser and try again, but choose another way to sign-in"*.
Copy link
Copy Markdown
Contributor

@namkedia namkedia Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What does registering security info here mean? Accessing security info requires an MFA session no older than 10 mins

Copy link
Copy Markdown
Contributor Author

@andrequeda andrequeda Apr 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Registering authentication methods in aka.ms/mysecurityinfo. It's the expression used in other docs and even in audit logs. See https://learn.microsoft.com/en-us/entra/identity/authentication/howto-registration-mfa-sspr-combined-troubleshoot for reference.

Copy link
Copy Markdown
Contributor Author

@andrequeda andrequeda Apr 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it help to hyperlink https://learn.microsoft.com/en-us/entra/identity/authentication/concept-registration-mfa-sspr-combined on that "registering security info" text?

Copy link

Copilot AI Apr 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The first sentence in this known-issue bullet is a long, hard-to-parse chain of clauses ("requires… leading… if…"). Consider rewriting as 2–3 shorter, active-voice sentences (for example: explain the 10-minute MFA requirement, then the resulting MFA prompt, then how that can fail the enforced authentication strength) to improve readability and reduce ambiguity.

Suggested change
- **Authentication strength and registration of security info**: Registering security info requires an MFA session no older than 10 minutes, leading to an interactive request for MFA if such requirement isn't met. This can lead users to choose an MFA method that, when combined with the first factor authentication method previously used, doesn't satisfy the enforced authentication strength, resulting in the error *"Let’s try something else. Another sign-in method is required to access this resource. Close your browser and try again, but choose another way to sign-in"*.
- **Authentication strength and registration of security info**: Registering security info requires an MFA session that's no older than 10 minutes. If the session is older than 10 minutes, the user is prompted to complete MFA interactively. The user might then choose an MFA method that, when combined with the previously used first-factor authentication method, doesn't satisfy the enforced authentication strength. This results in the error *"Let’s try something else. Another sign-in method is required to access this resource. Close your browser and try again, but choose another way to sign-in"*.

Copilot uses AI. Check for mistakes.


Copy link
Copy Markdown
Contributor Author

@andrequeda andrequeda Apr 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@namkedia - removed this

## FAQ

### Should I use an authentication strength or the policy for authentication methods?
Expand Down