Multi Factor (MFA) App Password Missing or Blank – Office 365

 

Symptoms for missing Multi Factor Authentication (MFA) app password in O365:

• You enabled Multi-factor Authentication (MFA) on Office 365 (O365) portal or Microsoft 365
• MFA works, and your user(s) are able to log on to the office.com website using it.
• You don’t see the “app password” listed anywhere, and the Account Settings view seems to be missing that section.
• You set up a conditional access policy for Multi Factor, per the Microsoft how-to article.

What are app passwords in office 365 or Azure?

App passwords are unique passwords used to authenticate legacy software to Office 365.

The primary use case is Outlook 2010 , or Outlook 2016. For example, these could have been standalone deployments before Office 365 was adopted.   These older versions of Office may not know how to handle a multi-factor prompt.

If your organization uses Office 365, I recommend installing the latest version of Office 365 from office.com.  The latest versions know how to handle multi-factor and don’t need app passwords.

Most users don’t use app passwords.

What does missing app password look like?

You should be able to view or create app passwords from the user’s account settings in Office 365.

If you are having this issue, the area for app passwords is blank. The picture above shows a missing app password area. It should be right under Contact Preferences.

Root cause for missing multi-factor app password:

The Office 365 admin portal has two separate ways to enable MFA for users.  One way is to use the Admin > Users > Multi-factor Authentication menu for individual users. The second way is to set up a Conditional Access Policy.   Microsoft articles say to use the Conditional Access Policy, but there is a problem with that.

There appears to be a bug where app passwords aren’t enabled properly when you use Conditional Access Policies.

To fix the problem, you need to enable multi factor using the Users menu, not conditional access policies.

The good news is that you don’t need to abandon your conditional access policy entirely. Just use this fix for individuals who need an app password, not everyone.

How to fix missing multi-factor authentication app password in Office 365

To enable application passwords in O365, you need to use the Multi-factor authentication page in admin center.

Navigate to Office 365, log on with your admin account

Click Admin from the menu

Click Users > Active Users from the menu

In the center, you will see a link to “Multi-factor authentication”. Click this link.

Your users list will display. You can filter for individual users here.

Pick the user that needs an app password and click “Enable”.

Enable the user here even if you have already set up a conditional access policy for MFA that includes the user.

For most organizations, you should be fixed now. When I tested, this took effect immediately and I create my app password as the user within 30 seconds.

Recently (May 2020 and later), we are seeing more complex issues that are not resolved by enabling MFA in the users area. Read on for information about fixing those issues.

Modern Authentication fix for missing O365 app password

Thanks to Rob Ryan for sending me these fix steps. Cheers!

Symptoms:

• The App Password is missing no matter if we enable or disable MFA from Admin Center > Users.
• Disabling MFA did not remove the requirement for multi-factor when we log on with an incognito browser.
• We could not find any conditional access policies, and no one had set up any.
• Tested email connectivity using testconnectivity.microsoft.com (Outlook test). This failed with an error saying that a conditional access policy denied access.

His account definitely had conditional access policies applied but they were hidden, possibly because his O365 license didn’t have Active Directory Premium 2 rights.

We eventually put in a ticket to Microsoft support, and they pointed us in the correct direction.

The issue was a setting under Office 365 Admin Panel.  There is a setting for “Modern Authentication”, that needs to be turned off for some apps that have a different or older Exchange Authentication process.

(Admin center > Settings > Org Settings > Services Tab > Modern Authentication)

This setting can be found in the Admin Panel by clicking “Settings” in the left hand menu panel and then clicking “Org Settings” under the drop down menu.  Then click on “Modern Authentication” in the list of settings.  Toggle to “off”  wait 2 – 3 hours.  

Then to set “App “Password, go under the user My Account, “Security & privacy”, “Additional security verification”, “Create and manage app passwords”.  In older versions of Office 365 the App Password option was in the title banner of the page, in larger font next to “Security Info”.   It is now found by clicking on the “+ Add Method Button”, when available.

Links for O365 Modern Authentication articles by Microsoft:

Microsoft Modern Authentication: https://docs.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication?view=o365-worldwide#enable-modern-authentication-for-your-organization

Exchange MA (includes how to connect with powershell): https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/enable-or-disable-modern-authentication-in-exchange-online

Alternate fix for missing o365 app password

Thanks to Jim Hill for sending these alternate fix steps which worked for him. You can see his original message in the comments. Cheers!

I figured out a solution! I am not sure if these are the exact steps I did. But the root cause was previously having a conditional access policy previously applied to that user.

-Make sure the CA policy for MFA is not enabled. Mine was the Legacy rule, “Baseline policy: Require MFA for admins (Preview)”
-Disable the MFA for that user in the Office 365 Admin.
https://account.activedirectory.windowsazure.com/UserManagement/MultifactorVerification.aspx?BrandContextID=O365
-Create a new CA policy in Azure AD. Have it grant access and require MFA, and only apply just to that user.
-Go back to the Office 365 MFA admin and enable then disable the MFA requirement for that user a few times. I did it four times. Leave with it disabled.
-Return to Azure and remove that user from the CA policy requiring MFA. Leave it enabled but just not applied to any users.
-Return to Office 365 admin and enable MFA for that user.
-Initiate a screen sharing session with that user. Have them log into their MFA set up screen.
https://aka.ms/MFASetup They will then see and be able to create a new app password.

This took me a month to figure out, and my exact steps may not have been exactly as I said above. Hopefully the whole community can figure out the best way.

Where can I manage Office 365 app passwords for multi factor?

Log on to office.com with the user account that needs an app password

Click on your account icon at the top right corner (normally shows your initials)

Now click My Account

Click Security and Privacy

Expand Additional Security Verification

Click Create and manage app passwords

From here, you can create your app password.

This is what it is supposed to look like.