Azure AD Security defaults MFA not enforced for user loging to PowerBI

[edgstr]

Hello everyone,

We have security defaults enabled through Active directory for specific tenant. While users log in to azure portal they seem to require MFA when needed according to "
Security defaults", however the ones using Power BI app (user account configured in azure AD - type 'Guest') - were not enforced to register for MFA and in the Azure AD sign in logs I see that required MFA is single factor only. Does security defaults does not cover PowerBI mfa (when auth is done via Azure AD) - and that should be configured in some other way (conditional access, powerbi admin panel or sth)?

[GilbertQ]

Hi @edgstr 

My understanding is that you would have to apply MFA for your guest users. And in order to do that you would need to chat to your Network/Azure Admin to configure this for you.

[edgstr]

Since we have "Security defaults" enabled in Azure AD, MFA is applied to all AD users (we are not using conditional access as it requires upgrade in AD service tier). Other guest users while loging into Azure portal are forced to use MFA, however we are only seeing this behaviour with PowerBI authentification. So far I understood from MS documentation that 'security defaults' gives you default MFA without per-user configuration that should enable MFA for other MS SAAS offerings which use Azure AD for authentification.

[GilbertQ]

Hi @edgstr 

As far as I am aware the MFA would need to be configured to the guest accounts?

[edgstr]

Hi Gilbert,

By saying configured - what do you mean exactly ? Through Azure AD, Power BI platform ? And are you saying security defaults in Azure AD does not apply MFA for other apps like power BI for Guest user specifically ? Because what I have red in MS articles that security defaults forces MFA not only for Azure portal logins but for other apps like office 365, MS teams etc, however I did not found anything related to user Type. So a bit lost here.