Logic App - O365 connector - Multi-Factor Authentication

Question

has anybody managed to send an email in a logic app from an O365 account with mfa enabled?

When I try to add the connection it shows the Azure AD login popup, it gets authenticated with SSO (my pc is joined to Azure AD) anc then in O365 connector I have this error

OAuth2Certificate authorization flow failed for service 'Office 365 (Discovery, Certificate)'. AADSTS50079: Due to a configuration change made by your administrator, or because you moved to a new location, you must enroll in multi-factor authentication to access '00000002-0000-XXXX-XXXX-000000000000'. Trace ID: xxxxxxx-4689-4387-b215-d0590b331000 Correlation ID: 21eaa05b-xxxx-yyyy-893a-c2ce136d6e51 Timestamp: 2017-06-14 08:55:00Z

Hope you can help. Thank you

tojamismis · Accepted Answer · 2018-04-18 02:53:27Z

1

This is long after closing. But in AAD, there is a "moved to a new location" flag that can get set, automatically triggering the need for MFA. If you do face this, check the conditional access locations in Azure and see if your AAD admin can clear the flag. (Or set up the original account with named locations in place.)

https://learn.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access-locations

answered Apr 18, 2018 at 2:53

tojamismis

112 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

4c74356b41 · Accepted Answer · 2017-06-14 09:37:41Z

0

I wouldn't expect this to be possible. I've never seen automated MFA logins in Azure. I would love to be disproved thou.

answered Jun 14, 2017 at 9:37

4c74356b41

71.5k7 gold badges118 silver badges155 bronze badges

1 Comment

ing.alfano Over a year ago

How about using app password?

Paul Summers · Accepted Answer · 2017-06-15 03:47:05Z

0

The short answer is that I doubt this is possible, much less supported.

Since a LogicApp is essentially a "service", I think the correct approach would be to register your application in Azure AD and use app-only permissions and give your service Mail.Send permissions. This would allow your application to send as any user. Alternatively, create a "service account" that does not have MFA enabled -- but this is definitely the less secure approach and any credential changes have to be changed in code, rather than at an administrative level as the Azure AD app registration would allow.

https://msdn.microsoft.com/en-us/Library/Azure/Ad/Graph/howto/azure-ad-graph-api-permission-scopes#app-only-vs-delegated-scopes

https://apps.dev.office.com

answered Jun 15, 2017 at 3:47

Paul Summers

1636 bronze badges

3 Comments

ing.alfano Over a year ago

I have a corporate account with Azure AD domain and I am not sure I can give permissions to my logic app since I don't have admin rights but I will give it a try

Paul Summers Over a year ago

Yeah, that could be a problem. If it's a corporate app, maybe they'll make an exception :-)

Tracy Over a year ago

@PaulSummers - Am I correct in understanding that you are suggesting creating an Azure application registration for the Logic App? And if so, how do I override the credential prompt that appears for Logic App connectors?

Collectives™ on Stack Overflow

Logic App - O365 connector - Multi-Factor Authentication

3 Answers 3

Comments

1 Comment

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

1 Comment

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related