Login to Azure CLI with MFA

user_8833604 0
Viewed 1485

Azure CLI installed on a Windows (and Linux?) OS apparently uses Device Code Authorization flow to login the user. Given that such a user may be required to use multifactor (MFA) authentication to perform administrative tasks, how can MFA be implemented for this use case (CLI login, enforce MFA), using Azure AD as the Identity Provider?

My understanding is that Azure's implementation of the login to a CLI uses the browser for the initial authentication - and this was done so that the user doesn't type in login secrets inside the CLI.

multi-factor-authentication azure command-line-interface
1 Answers

My understanding is that Azure's implementation of the login to a CLI uses the browser for the initial authentication - and this was done so that the user doesn't type in login secrets inside the CLI.

Yes, By default in Azure when you are trying to login through cli it will initiate a browser session to enter your credential & to procced further logging.

If you want to enable MFA while logging into the portal using CLI you have to enable the MFA per user in the active directory as shown below.

enter image description here

If you want to make sure that every user who is trying to logging through Azure CLI they have to use Multi factor authentication then you can achieve this by creating a conditional access policy.

We have tested this in our environment , by creating a user in the AAD & enabling the MFA-per user it is working fine.

You can refer the below sample output for reference:

enter image description here

user_159687200
Related