Lease management portal blocks external users with repeated MFA prompts

ERP Microsoft Dynamics 365
, , , , , , , ,
1

Our Real Estate Management lease portal was recently opened to external lessors via Azure AD B2B guest invitations. However, external users are getting stuck in an MFA loop - they complete MFA authentication successfully, but then get prompted again immediately when accessing any lease documents or reports.

Internal users don’t have this issue. The external users can see the dashboard, but clicking into any lease detail triggers another MFA challenge. We’ve verified their MFA methods are registered correctly in their home tenants. This is blocking our vendor collaboration workflow. Anyone experienced similar behavior with Azure AD B2B and D365 conditional access policies?

system 2

Here’s the complete solution for fixing Azure AD B2B MFA loops in D365 Lease Management:

Root Cause Analysis:

The MFA loop occurs because your conditional access policy with ‘Sign-in frequency: Every time’ treats each D365 action (document access, report navigation, form submission) as a separate resource request requiring fresh authentication. For B2B guest users, this is compounded by cross-tenant token validation, creating the endless MFA cycle.

Azure AD B2B Policy Configuration:

Create a dedicated conditional access policy for external users:

  1. Navigate to Azure AD > Security > Conditional Access > New Policy
  2. Name it ‘B2B Guest Access - D365 Lease Management’
  3. Under Assignments > Users: Select ‘Guest or external users’ > ‘B2B collaboration guest users’
  4. Under Cloud apps: Select ‘Microsoft Dynamics 365’ or your specific D365 app registration
  5. Under Conditions > Locations: Include ‘Any location’ but consider excluding trusted locations if applicable

MFA and Session Controls:

Configure balanced authentication requirements:

  1. Under Access controls > Grant: Select ‘Grant access’ and check ‘Require multi-factor authentication’
  2. Under Session controls:
    • Sign-in frequency: Set to ‘4 hours’ (or 8 hours for less sensitive environments)
    • Persistent browser session: Set to ‘Always persistent’
    • This maintains the authenticated session across D365 resource accesses

External User Trust Settings:

Adjust cross-tenant access settings to prevent policy conflicts:

  1. Go to Azure AD > External Identities > Cross-tenant access settings
  2. Under ‘Default settings’, click ‘Edit inbound defaults’
  3. Under ‘Trust settings’, enable ‘Trust multi-factor authentication from Azure AD tenants’
  4. This allows MFA performed in the guest’s home tenant to satisfy your policy requirements
  5. Optionally enable ‘Trust compliant devices’ if your partners have device management

Conditional Access Policy Ordering:

Ensure proper policy precedence:

  1. Verify your new B2B policy has higher priority than the ‘Every time’ policy
  2. Modify your existing strict policy to explicitly exclude guest users
  3. Test with a single external user before rolling out to all vendors

Monitoring and Validation:

Set up monitoring to ensure the fix works:

  1. Enable sign-in logs for external users (Azure AD > Monitoring > Sign-in logs)
  2. Filter by ‘User type: Guest’ and monitor authentication frequency
  3. Check for any remaining authentication failures or loops
  4. Collect feedback from external users on their experience

Additional Security Layers:

Maintain security while improving usability:

  1. Implement app protection policies for D365 mobile access
  2. Enable Azure AD Identity Protection for risk-based access
  3. Configure named locations to restrict access from untrusted regions
  4. Set up alerts for unusual sign-in patterns from B2B guests
  5. Require terms of use acceptance for first-time B2B access

The 4-hour sign-in frequency with persistent browser sessions provides the right balance - external users authenticate once when starting their session, then work uninterrupted for 4 hours. Combined with MFA trust from their home tenant, this eliminates the loop while maintaining strong security posture for lease document access.

This draft is based on general Microsoft Dynamics 365 knowledge. It has not been verified against your specific version and environment. Practitioners: verify the steps and share your experience below.

3

This sounds like conflicting conditional access policies between your tenant and the guest users’ home tenants. When B2B guests access resources, both tenants’ policies can apply. Check if your conditional access policies have session controls set to ‘Sign-in frequency’ that’s too aggressive. Also verify if the external users’ home tenants have policies that conflict with yours.

4

I checked our conditional access policies and we do have a policy with ‘Sign-in frequency: Every time’ for external users accessing financial data. Could this be causing the loop? The policy was set up by our security team to ensure external access is always verified.

6

That ‘Every time’ setting is definitely your culprit. With Azure AD B2B, each resource access within D365 (like opening a document or navigating to a report) can trigger a new authentication check if sign-in frequency is set that strictly. This creates the MFA loop you’re experiencing. External users need a more balanced approach - set sign-in frequency to 1 hour or 4 hours for B2B guests. You can still maintain security with device compliance checks and location restrictions without forcing MFA on every single action. Create a separate conditional access policy specifically for B2B guest users that’s less restrictive than your internal policy while still meeting compliance requirements.

7

Also check if you have persistent browser session disabled for external users. When combined with aggressive sign-in frequency, this forces full re-authentication constantly. Go to Azure AD > Security > Conditional Access > Session controls and enable ‘Persistent browser session’ for your B2B guest policy. This allows the browser to maintain the session token while still respecting your sign-in frequency limits.

8

That makes sense. So I should create a dedicated conditional access policy for B2B guests with sign-in frequency set to maybe 4 hours and persistent browser sessions enabled? Would this still be secure enough for lease document access?

9

Four hours is reasonable for B2B collaboration scenarios. Just ensure your policy includes device state checks (compliant or hybrid joined) and location restrictions if needed. You can also layer in app protection policies for additional security. The key is balancing usability with security - forcing MFA every minute doesn’t actually improve security, it just trains users to click through prompts without thinking.

nicholas_guru 11

The policy was set up by our security team to ensure external access is always verified.