Revise MFA recommendation for known devices#1907
Revise MFA recommendation for known devices#1907ChristianCB83 wants to merge 1 commit intoMicrosoftDocs:mainfrom
Conversation
Updated the recommendation for minimizing MFA prompts from known devices, emphasizing Conditional Access Sign-in frequency over the previous method.
|
@ChristianCB83 : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
|
Learn Build status updates of commit 1563e36: ✅ Validation status: passed
For more details, please refer to the build report. |
There was a problem hiding this comment.
Pull request overview
This PR updates guidance for minimizing MFA prompts from known devices, shifting the recommendation away from the legacy "Remember MFA on trusted devices" setting to the newer Conditional Access Sign-in frequency approach. The update emphasizes that Microsoft no longer recommends the Remember MFA feature and provides transitional guidance for existing deployments.
Changes:
- Added a NOTE block indicating that Remember MFA on trusted devices is deprecated as the recommended approach
- Introduced new guidance recommending Conditional Access Sign-in frequency for controlling MFA prompts
- Provided transitional guidance for organizations still using the legacy Remember MFA feature
| For an optimal user experience and stronger security posture, Microsoft recommends using Conditional Access Sign-in frequency to control how often users are prompted for MFA on trusted devices, trusted locations, or risk sessions. | ||
| If you continue to use Remember MFA on a trusted device, ensure the duration is configured to 90 days or more. However, new and updated deployments should prefer Conditional Access–based session management instead. |
There was a problem hiding this comment.
The NOTE block content should be properly formatted according to Microsoft Learn documentation conventions. Lines 18-20 should all be within the NOTE block. Currently, only line 18 is inside the block quote marker, but lines 19-20 appear to be continuation text that should also be part of the note.
The proper formatting should have all related content indented with '> ' at the start of each line within the NOTE block.
| For an optimal user experience and stronger security posture, Microsoft recommends using Conditional Access Sign-in frequency to control how often users are prompted for MFA on trusted devices, trusted locations, or risk sessions. | |
| If you continue to use Remember MFA on a trusted device, ensure the duration is configured to 90 days or more. However, new and updated deployments should prefer Conditional Access–based session management instead. | |
| > For an optimal user experience and stronger security posture, Microsoft recommends using Conditional Access Sign-in frequency to control how often users are prompted for MFA on trusted devices, trusted locations, or risk sessions. | |
| > If you continue to use Remember MFA on a trusted device, ensure the duration is configured to 90 days or more. However, new and updated deployments should prefer Conditional Access–based session management instead. |
| > [!NOTE] | ||
| > The Remember multifactor authentication on trusted device setting is no longer the recommended approach for reducing MFA prompts. | ||
| For an optimal user experience and stronger security posture, Microsoft recommends using Conditional Access Sign-in frequency to control how often users are prompted for MFA on trusted devices, trusted locations, or risk sessions. | ||
| If you continue to use Remember MFA on a trusted device, ensure the duration is configured to 90 days or more. However, new and updated deployments should prefer Conditional Access–based session management instead. |
There was a problem hiding this comment.
The hyphen in "Conditional Access–based" uses an en-dash (–) instead of a standard hyphen (-). According to the Microsoft Writing Style Guide, compound modifiers should use a standard hyphen. Change to "Conditional Access-based" with a regular hyphen for consistency.
| If you continue to use Remember MFA on a trusted device, ensure the duration is configured to 90 days or more. However, new and updated deployments should prefer Conditional Access–based session management instead. | |
| If you continue to use Remember MFA on a trusted device, ensure the duration is configured to 90 days or more. However, new and updated deployments should prefer Conditional Access-based session management instead. |
| > [!NOTE] | ||
| > The Remember multifactor authentication on trusted device setting is no longer the recommended approach for reducing MFA prompts. | ||
| For an optimal user experience and stronger security posture, Microsoft recommends using Conditional Access Sign-in frequency to control how often users are prompted for MFA on trusted devices, trusted locations, or risk sessions. | ||
| If you continue to use Remember MFA on a trusted device, ensure the duration is configured to 90 days or more. However, new and updated deployments should prefer Conditional Access–based session management instead. |
There was a problem hiding this comment.
According to the custom coding guidelines (CodingGuidelineID: 1000000), all Markdown content created or substantially modified with AI assistance must include an ai-usage front matter entry. This content update adds significant new guidance (lines 17-20) that appears to be substantive enough to warrant adding ai-usage metadata. Please add either ai-usage: ai-generated or ai-usage: ai-assisted to the front matter section based on the level of AI involvement in creating this content.
|
Can you review the proposed changes? IMPORTANT: When the changes are ready for publication, adding a #label:"aq-pr-triaged" |
| This article covers the recommendation to minimize multifactor authentication prompts from known devices. This recommendation is called `tenantMFA` in the recommendations API in Microsoft Graph. | ||
|
|
||
| > [!NOTE] | ||
| > The Remember multifactor authentication on trusted device setting is no longer the recommended approach for reducing MFA prompts. |
|
@kvenkit , not documented as far as I know, but this is explicitly noted on the UI: 
I believe it still worth mentioning that "For an optimal user experience and stronger security posture, Microsoft recommends using Conditional Access Sign-in frequency to control how often users are prompted for MFA on trusted devices, trusted locations, or risk sessions." |
Updated the recommendation for minimizing MFA prompts from known devices, emphasizing Conditional Access Sign-in frequency over the previous method.