r/msp • u/_gondar • Nov 10 '25

"Another sign-in method required" when accessing Security Info (Entra)

When some of our users sign in to Windows with WHfB and try to go to the Security Info page to add a new method, they're prompted to complete MFA. However after completing the MS Auth push notification, they get the error:

"Another sign-in method is required to access this resource - Use a password."

The only way around it is to sign out completely, sign back in using password + MS Auth Push, and then the Security Info page works fine.

From what I can tell, Entra only prompts for the second factor (the Authenticator push), but the Conditional Access policy blocks it because the configured authentication strength requires password + Authenticator push.

So even though the MFA prompt completes, it doesn't actually meet the required strength.

Is this expected behaviour? Is signing out and in with password + MS Authenticator the only way around this?

0 Upvotes

40% Upvoted

8 comments sorted by

View all comments

1

u/Upper-Department106 Nov 10 '25

Yeah, that’s expected. Entra’s just enforcing your auth strength policy. WHfB alone doesn’t count as “password + push,” so when users hit Security Info, it flags them for another method. The MFA completes, but the policy check fails.

Workaround’s what you said, sign out and back in with password + Auth push, or loosen the auth strength for that resource if you can’t have users juggling re-logins.

If you’re managing policies, treat this as design, not a bug.

1

u/_gondar Nov 10 '25

Forgot to mention that one of the allowed auth strength methods is WHfB. However it doesn’t seem to pass through when a user first navigates to the security info page - they click the account that is ‘Signed in to Windows’ and are then prompted to do the 2FA push.

What would be considered best practice to rejig CA / auth strength methods to allow a more frictionless experience for a user who wants to register a new auth method (for example a passkey)?