Multi-factor authentication setup fails for risk management workflows

QMS Veeva Vault QMS
, , , , , , , ,
1

We’re experiencing issues with MFA setup for our risk management users in Vault QMS 23R2 integrated with Azure AD. When users try to complete their MFA enrollment, the process fails at the verification stage. The Azure AD conditional access policy is configured to require MFA for all Vault QMS access, but the SAML MFA claims don’t seem to be passing through correctly.

The error we see in the Vault logs:


SAML assertion validation failed: MFA claim missing
User provisioning blocked - authentication_method claim not found

This is blocking our risk workflows since users can’t authenticate to create or approve risk assessments. We’ve verified that just-in-time user provisioning is enabled in our SAML configuration, but something isn’t working correctly with the MFA claim mapping. Has anyone successfully configured Azure AD MFA with Vault QMS risk management workflows?

2

I’ve seen this before. The issue is usually in the Azure AD enterprise application configuration. Check if your SAML claims are properly mapped - specifically the AuthenticationMethodsReferences claim. This needs to be present in the SAML assertion for Vault to recognize that MFA was completed.

3

Thanks for the suggestions. I checked the Azure AD enterprise app and the AuthenticationMethodsReferences claim is configured. However, I’m wondering if the issue is with the just-in-time provisioning timing - maybe the user profile isn’t fully created before the MFA claim validation happens?

4

That’s a good point about JIT provisioning timing. In my experience, you need to ensure that the SAML assertion includes all required user attributes before the MFA validation step. The provisioning process should complete first. Check your Azure AD claim mapping to make sure email, username, and authentication method are all in the same assertion. Also, look at the Vault security settings for the order of authentication steps - user provisioning should happen before MFA validation.

5

I’d also recommend checking the Azure AD token lifetime settings. If the SAML token expires too quickly, it might cause issues during the JIT provisioning process. We set ours to 60 minutes to give enough time for all the authentication and provisioning steps to complete properly.

6

Here’s the complete solution based on what I’ve implemented successfully:

1. Azure AD Conditional Access Configuration: Your conditional access policy needs to be properly scoped. Go to Azure AD → Security → Conditional Access and verify that:

  • The policy targets the Vault QMS enterprise application
  • MFA is required but set to “Require multi-factor authentication” not “Require compliant device”
  • The policy allows the MFA registration process itself (exclude first-time users or create a separate policy for registration)

2. SAML MFA Claims Configuration: In Azure AD enterprise application for Vault QMS:


Claim name: http://schemas.microsoft.com/claims/authnmethodsreferences
Source: Transformation
Transformation: Extract authentication method references
Parameter 1: AuthenticationMethodsReferences

This claim MUST be included in the SAML assertion. Also add:


Claim name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
Source attribute: user.mail

3. Just-in-Time User Provisioning Order: In Vault QMS Admin → Settings → Security → SAML Configuration:

  • Enable “Allow Just-in-Time User Provisioning”
  • Set “User Provisioning Timing” to “Before Authentication” (this is critical)
  • Map the email claim to the Vault user email field
  • Ensure “Require MFA Claim” is checked

4. Vault Security Policy for Risk Management: Go to Admin → Business Admin → Security Policies → Risk Management:

  • Verify that “Require Multi-Factor Authentication” is enabled
  • Set “MFA Claim Validation” to “Validate on each login”
  • Add the specific claim name from Azure AD: `http://schemas.microsoft.com/claims/authnmethodsreferences 5. Testing Process:
  • Clear any existing failed authentication attempts in Vault
  • Have a test user complete MFA enrollment in Azure AD first (outside of Vault)
  • Then have them log into Vault QMS - the JIT provisioning should create their profile with the MFA claim already present

Common Pitfall: The “MFA claim missing” error usually means the claim name in Vault doesn’t exactly match what Azure AD sends. Use a SAML decoder tool to inspect the actual assertion and verify the exact claim URI.

After implementing these changes, your risk management workflows should work correctly with Azure AD MFA. The key is ensuring the provisioning happens before MFA validation and that all claim names match exactly between Azure AD and Vault.

7

We had a similar problem last month. In our case, the Azure AD conditional access policy was triggering MFA, but the SAML token wasn’t including the authentication method claim. You need to add a custom claim rule in Azure AD that explicitly includes the MFA verification status. Also verify that your Vault QMS security policy is configured to accept the specific claim name that Azure AD sends.