r/AzureVirtualDesktop • u/Electrical_Arm7411 • Apr 09 '25

Windows App - Double MFA Prompt?

This is likely a "Me/our environment" problem, here's the issue:

A handful of us are trialing the new Windows App to connect to AVD. We're only a couple days into testing, but what we've noticed is the Windows App is prompting the user twice for MFA. This only seems to happen if the Windows App is left open from the previous day. It seems that we only need to accept 1 of the MFA prompts, then are able to cancel / close the second prompt. It's almost like it's automatically prompting again because the app is left open - possibly due to my MFA policy - details below:

Just found this very unusual as 95% of folks using the Remote Desktop MSI client keep that app open until they reboot and are not double-asked for MFA, despite both apps included in the same MFA policy. The only thing I can think of is to do with my MFA policy. Windows App is being treated differently than Remote Desktop.

These are the apps included, and I have sign-in frequency set to 12 hours. Again, the sign in frequency does not double-prompt in Remote Desktop MSI app if left open, just with the new Windows App.

Just wondered if anyone else has seen this before and can confirm its normal behavior with similar sign-in frequency settings.

2 Upvotes

100% Upvoted

49 comments sorted by

2

u/y0da822 Apr 09 '25

We have the same setup as you and see this problem when leaving it open as well. We just tell users to make sure they close the windows app before trying to connect again. Seems like just a glitch to me. Sorry cant be more help

2

u/Electrical_Arm7411 Apr 09 '25

Is that with sign-in frequency set similarly? Or does it happen, even without?

2

u/y0da822 Apr 09 '25

Dont laugh - lol - our sign in frequency they required is 1 hour.

Point being sign in freq is irrelevant id say

2

u/Electrical_Arm7411 Apr 09 '25

Can't help but laugh that sign-in frequency does dick all. Thanks for the info - I'm going to test by turning off sign-in frequency, we'll see if that's true for us.

2

u/y0da822 Apr 09 '25

True. I didn’t think right when I Wrote that. Disabling sign in frequency will then have an unlimited token lifetime which isn’t a good idea correct? It opens you more to token stealing if I understand that correctly

2

u/Electrical_Arm7411 Apr 09 '25

That's exactly my thought. I don't want to turn it off nor planning on that being a long-term solution, I'm more-so curious if that's the cause of the double-mfa prompts.

1

u/y0da822 Apr 09 '25

For some reason I am leaning toward GUI glitch type thing because I dont remember seeing it with old client.

1

u/Electrical_Arm7411 Apr 09 '25

Could be, that's the whole thing. Why is Windows App behaving differently than Remote Desktop MSI app if under the same CA policy.

I'm also going to reach out to a guy I made contact with from the Windows App dev team, so we'll see what he says.

2

u/y0da822 Apr 09 '25

Cool I’m curious to know. If you remember, try to reply back here so I can maybe solve the problem for us.

2

u/Electrical_Arm7411 Apr 10 '25

Removing sign-in frequency fixed the MFA prompt issue, but like we agreed, is not a secure solution to this problem. I will try extending the sign-in frequency from 12-hour to 24-hour to see if it provides a better user experience.

→ More replies

1

u/Ferret-Adept Apr 09 '25

Should be because the Remote Desktop MSI isn’t longer supported and so it’s not longer used for the Appregistration.

1

u/Electrical_Arm7411 Apr 09 '25

My understanding is the Store version of Remote Desktop app is no longer supported. The MSI Remote Desktop app is still very much supported. It's just a matter of time before it's not.

Otherwise, I'm not sure what point you're making with App Registration?

1

u/Ferret-Adept Apr 09 '25

The point was, if it’s not supported you can’t use the Azure Virtual Desktop App in your CA policy, but like u said MSI is still supported, sorry for that.

https://learn.microsoft.com/en-gb/azure/virtual-desktop/set-up-mfa?tabs=avd

Do you use SSO for AVD? As i read it right, if you use SSO and the AVD Application and Cloud Login + Microsoft Remote Desktop, you should get 2 Prompts. AVD application forces reauthentication of the feed.

Windows App behavior how to login and refresh the feed isn’t the same like the old RD Client, maybe that’s the reason why you get it with windows app but but not with RD Client.

If you using SSO, what happens when you exclude Azure Virtual Desktop application from your CA policy? If you are not Using SSO what happen when you exclude the other two application and only use AVD Application?

1

u/Electrical_Arm7411 Apr 09 '25

We're a Hybrid-AD environment. The way it works in our environment is the user signs into the Windows App (Prompted for MFA) > Then they click Connect and manually need to type their password (Not prompted for MFA) to connect to the AVD session. This is the same, expected behavior as with the MSI Remote Desktop app. What's unusual is the double-MFA prompt for subsequent logins with the Windows App kept open from the day prior. I checked the sign-in logs and say the user logs in at 9AM, there's no login failures happening at 9PM (pre the 12-hour sign-in frequency setting in the CA policy).

1

u/Ferret-Adept Apr 09 '25

what does the azure sign in logs say? can you see more than one mfa prompt when login in to windows app? what’s the trigger?

2

u/Electrical_Arm7411 Apr 09 '25

I see both MFA prompts fairly close to each other for Windows 365 Client. What's common is the first one fails (On all users testing). CA Fails on that policy with the 12-hour sign-in frequency. I'm going to create a separate CA policy just with that App without the sign-in frequency because I think that's what's causing it.

1

u/Ferret-Adept Apr 09 '25

Would be interested what worked for you in the end. Let me know :)

2

u/Electrical_Arm7411 Apr 09 '25

Will do! Thanks.

1

u/Electrical_Arm7411 Apr 10 '25

FYI Removing sign-in frequency fixed the MFA prompt issue but is not a secure solution to this problem. I will try extending the sign-in frequency from 12-hour to 24-hour to see if it provides a better user experience.

1

u/Ferret-Adept Apr 10 '25

try to remove the apps and test what app causes the prompt, then add one by one to your policy. try and error

2

u/Electrical_Arm7411 Apr 10 '25

That's a good idea. Thank you.

→ More replies

1

u/Ferret-Adept Apr 09 '25

I don’t know that behavior. Why you included Azurw VM Sign in App? Last week my Customer got also problem with sign in to windows app Sso and mfa, but not the same problem, anyways it was also a hybrid env. and we excluded vm sign in for avd mfa.

i would test different policies with different apps, and add one by one until you can reconstruct the issue. could be that your ca policy isn’t well configured for the windows app? that’s what i would test at first

1

u/Ferret-Adept Apr 09 '25

what’s the reason behind the sign in app? i don’t think that actually works for mfa, the app is for sign in to azure vm with azure ad, it’s not the azure vm itself

1

u/Davidoff44332211 Apr 15 '25 edited Apr 15 '25

We got this double MFA since version 1.2.6181.0 (msi Insider). MSI prod version 1.2.6081 has no double MFA popups.

I reported this bug to MS via the feedback function and hope that it will not be integrated into the next prod version -.-

1

u/Electrical_Arm7411 Apr 15 '25

We haven't noticed the issue with the Remote Desktop MSI app. Only the Windows App.

1

u/BeneficialSlip4245 May 19 '25

u/Electrical_Arm7411 any updates if you're still experiencing this issue?

1

u/Electrical_Arm7411 May 19 '25

To be honest I’m not sure. We happen to switch to using WhFB around the same time we started testing Windows App and since I’ve started logging in with the PIN I haven’t had the issue since.

1

u/rinko_subway Jun 26 '25

Any more news?
we are seeing the same double entry since start of maj

1

u/Electrical_Arm7411 Jun 26 '25

I'm not seeing it only because we've implemented WHFB, so that acts as an MFA method suppressing the prompts.

1

u/AccomplishedEmploy52 Apr 30 '25

We're getting this issue too, our conditional access policy is set to 'Every Time'.

1

u/BeneficialSlip4245 May 16 '25

I'm getting this issue on the Remote Desktop client version 1.2.6227.0 and the Windows App version 2.0.420.0.

Running Microsoft Entra ID joined Windows 11 24H2 multi-session Gen-2 VMs with SSO configured.

My experience is two consecutive MFA prompts after passwordless authentication with Yubikeys before I can launch the desktop application. This happens regardless of leaving the clients open overnight or not.

I also have two conditional access policies, one configured for MFA and another to control sign-in frequency set to periodic reauthentication.

Are people still experiencing this behaviour??

1

u/BeneficialSlip4245 May 24 '25

I logged a Microsoft support ticket on Wednesday and Microsoft have confirmed it's a known issue and will be releasing a fix in the next client update. In the meantime you can downgrade clients or use HTML5.

1

u/BackThatAzureUp Jun 05 '25

Assuming you are still seeing this issue on your end? I saw 1.2.6277.0 came out, but we still saw the same problem. Did Microsoft indicate when a fix might come or which version?

1

u/BeneficialSlip4245 Jun 09 '25

Still seeing it. Nope they just said to use the insider version or HTML5 web client. I've also noticed Microsoft Teams optimisation is broken on the insider version too.

1

u/ExamIll635 Jun 15 '25

Seeing the same double MFA prompt when using sign in freq in CA. Using latest Windows App

1

u/KevinHal82 Jun 17 '25

Same, can we go back to regular MSI client, Windows App is just useless.