Email issues with new members of staff

[chrisgreenwood]

Hi,

 

We've been having issues with new members of staff (2 so far).

 

i will quote what they said

 

"I am having issues signing into my school microsoft account. When I try to sign in it asks me to use the microsoft authenticator app. When I go onto the app there are no codes. When I try and re-add my school account to the app it asks me to authenticate it through the app which I am unable to do whilst trying to sign in on the app. Finally when trying to log on to the account and I try say that I can't use the authenticator app it gives me two alternative options that require the use of the app. As a result of this I can not access the school microsoft account"

 

Does anyone know what may be going on?

 

I have one of the staff members coming in on Monday but just wondering if you IT wizards might know what's causing it to bug out like that?

[Cw2k]

Are they using the 2 digit method of authentication as that requires an internet connection. We had a handful of staff who had no data plan on their mobile and were not on WiFi so didn’t receive the 2 digit prompt.

Click the org in authenticator gives the 6 digit code that can get around that as that doesn’t require an internet connection.

 

 

The others cause of this we have seen if where they went though the self reg of mfa and stopped before they click next to send the 2 digit code. Looks like it is setup in the authenticator app but won’t work.

Edited July 14, 2023 by Cw2k

[chrisgreenwood]

I wil have a proper look on Monday but i know for some reason our trust requires you to have the authenicator app installed but i will try on monday as the teacher is coming in.

 

I did try and get him to redo everything from start but this is what he said

"I think if it is possible it might work if I could use a QR code to set it up again. When I first set up the authenticator app it gave me a QR code on my laptop that I could scan, this would bypass the initial login on the app and therefore hopefully allow the app and account to be connected properly again. Is there any way you can send me another QR code through this email so i can access it? sorry if this doesn't make sense."

 

It's such a pain but it is microsoft

[ckedu-local]

On the Authenticator app they can press the account and a 6 digit code appears there they can use to sign in with. Could it be that they're looking for?

[TechMonkey]

It sounds like they have reinstalled the Authenticator app and the new app has the generic account setup but not the full 2FA. It will show an account for your school domain but not give a 2FA number. It could be the MFA wasn't setup correctly.

 

If this is the case the only fix is to reset the MFA for that user and they set it up again. To do this find the user in Azure AD, go to Authentication Methods and there is a button at the top labelled "Require register multifactor authentication".

 

I have found that trying to setup MFA totally on a mobile phone is painful. Better to get them on a PC and only use the mobile device to setup Authenticator.

[PotNoodleTech]

To be fair having tried setting up MFA on an ipad with the authenticator app on an ipad which needs the authenticator app on the ipad working to set up mfa on the ipad......I can kinda see where your staff are coming from.

 

MS need to do a little bit of logic checking where it says "oh right the poor user is doing the entire authentication chain on one device, I will make it a bit easier for them"

[chrisgreenwood]

To be fair having tried setting up MFA on an ipad with the authenticator app on an ipad which needs the authenticator app on the ipad working to set up mfa on the ipad......I can kinda see where your staff are coming from.

 

MS need to do a little bit of logic checking where it says "oh right the poor user is doing the entire authentication chain on one device, I will make it a bit easier for them"

 

Oh it gets better

 

He came in today to show me, you sign in with outlook, it opens up the authenicator app, telling you to enter this code but you can't the enter the code because its telling you to enter this code so you're stuck in a loop, past it onto 2nd tier anyway

[chrisgreenwood]

It sounds like they have reinstalled the Authenticator app and the new app has the generic account setup but not the full 2FA. It will show an account for your school domain but not give a 2FA number. It could be the MFA wasn't setup correctly.

 

If this is the case the only fix is to reset the MFA for that user and they set it up again. To do this find the user in Azure AD, go to Authentication Methods and there is a button at the top labelled "Require register multifactor authentication".

 

I have found that trying to setup MFA totally on a mobile phone is painful. Better to get them on a PC and only use the mobile device to setup Authenticator.

 

Yep the guy from our support thingy had to reset the 2fa and then talk them through it on the phone (poor guy )