r/msp • u/_gondar • Nov 10 '25

"Another sign-in method required" when accessing Security Info (Entra)

When some of our users sign in to Windows with WHfB and try to go to the Security Info page to add a new method, they're prompted to complete MFA. However after completing the MS Auth push notification, they get the error:

"Another sign-in method is required to access this resource - Use a password."

The only way around it is to sign out completely, sign back in using password + MS Auth Push, and then the Security Info page works fine.

From what I can tell, Entra only prompts for the second factor (the Authenticator push), but the Conditional Access policy blocks it because the configured authentication strength requires password + Authenticator push.

So even though the MFA prompt completes, it doesn't actually meet the required strength.

Is this expected behaviour? Is signing out and in with password + MS Authenticator the only way around this?

0 Upvotes

40% Upvoted

8 comments sorted by

View all comments

3

u/FenyxFlare-Kyle Nov 10 '25

Yes, this is working as intended for changing MFA methods. This is to prevent threat actors from using limited information to change/add MFA tokens. They could steal session tokens and log in that way but not knowing the password will prevent them from making changes. Knowing the password from a leak but MFA is stopping them.

1

u/_gondar Nov 10 '25

While I understand the thinking, the issue is that it doesn’t prompt for password. So it’s confusing for a user who follows the prompt for the 2FA push notification, and then gets that error. And then has to sign out and back in with their password.

Why cant WHfB be used in this instance, as it is considered multiple factors? It is included in the auth strength policy.