Share via

Conditional Access & MFA - Issue

Karthik Palani 60 Reputation points
2025-05-03T15:54:58.7266667+00:00

Hi All,

We are trying to move to cloud from on-premises, we synced the users and enabled MFA via conditional access policy. Also in Conditional access policy we enabled sign in frequency as 8 hours and persistent browsing as always.

Now we are seeing below error in office and PDF documents which is saved in network share and locally. Even finance application is causing issue for few users, We even removed users from CAP policy but still it is throwing below error.

Should we upgrade to O365 apps? Or Is it due to SSO?. Is there any reason y this is happening and how to fix it. Please advice

Lock.png

Microsoft Authenticator
Microsoft Authenticator
A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation.
8,739 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jose Benjamin Solis Nolasco 1,476 Reputation points
    2025-05-03T17:19:02.44+00:00

    @Karthik Palani Good morning I hope you are doing well,

    Your issue is like an Office Activation or Authentication Loop

    Issue: Older versions of Office, such as Office 2013 or early builds of Office 2016, may not fully support Modern Authentication (OAuth 2.0). When MFA is enforced via Conditional Access, these versions can experience continuous sign-in prompts or authentication loops.

    Solution: Upgrade to Microsoft 365 Apps for Enterprise or ensure that Modern Authentication is enabled on existing Office installations.

    Reference: Modern Authentication configuration requirementsMicrosoft Learn

    Even after removing users from a CAP, the clients may continue to operate with previously cached tokens that were subject to the enforced policy. Until these tokens naturally expire—or you force a complete sign‐out—the “old” conditions may still be in effect. This can be particularly prominent in applications that do not actively refresh their sessions in the background. To troubleshoot, you might try clearing credentials or forcing users to log out and sign back in so that new tokens (issued without the overly stringent policy).

    😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.