Menu

o365

Multi Factor (MFA) App Password Missing or Blank – Office 365

, , , , , , , 25

Symptoms for missing Multi Factor Authentication (MFA) app password in O365:

  • You enabled Multi-factor Authentication (MFA) on Office 365 (O365) portal or Microsoft 365
  • MFA works, and your user(s) are able to log on to the office.com website using it.
  • You don’t see the “app password” listed anywhere, and the Account Settings view seems to be missing that section.
  • You set up a conditional access policy for Multi Factor, per the Microsoft how-to article.

What are app passwords in office 365 or Azure?

App passwords are unique passwords used to authenticate legacy software to Office 365.

The primary use case is Outlook 2010 , or Outlook 2016. For example, these could have been standalone deployments before Office 365 was adopted.   These older versions of Office may not know how to handle a multi-factor prompt.

If your organization uses Office 365, I recommend installing the latest version of Office 365 from office.com.  The latest versions know how to handle multi-factor and don’t need app passwords.

Most users don’t use app passwords.

What does missing app password look like?

You should be able to view or create app passwords from the user’s account settings in Office 365.

If you are having this issue, the area for app passwords is blank. The picture above shows a missing app password area. It should be right under Contact Preferences.

Root cause for missing multi-factor app password:

The Office 365 admin portal has two separate ways to enable MFA for users.  One way is to use the Admin > Users > Multi-factor Authentication menu for individual users. The second way is to set up a Conditional Access Policy.   Microsoft articles say to use the Conditional Access Policy, but there is a problem with that.

There appears to be a bug where app passwords aren’t enabled properly when you use Conditional Access Policies.

To fix the problem, you need to enable multi factor using the Users menu, not conditional access policies.

The good news is that you don’t need to abandon your conditional access policy entirely. Just use this fix for individuals who need an app password, not everyone.

How to fix missing multi-factor authentication app password in Office 365

To enable application passwords in O365, you need to use the Multi-factor authentication page in admin center.

office 365 portal steps to view multi factor authentication enable

Navigate to Office 365, log on with your admin account

Click Admin from the menu

Click Users > Active Users from the menu

In the center, you will see a link to “Multi-factor authentication”. Click this link.

Your users list will display. You can filter for individual users here.

Pick the user that needs an app password and click “Enable”.

Enable the user here even if you have already set up a conditional access policy for MFA that includes the user.

For most organizations, you should be fixed now. When I tested, this took effect immediately and I create my app password as the user within 30 seconds.

Recently (May 2020 and later), we are seeing more complex issues that are not resolved by enabling MFA in the users area. Read on for information about fixing those issues.

Modern Authentication fix for missing O365 app password

Thanks to Rob Ryan for sending me these fix steps. Cheers!

Symptoms:

  • The App Password is missing no matter if we enable or disable MFA from Admin Center > Users.
  • Disabling MFA did not remove the requirement for multi-factor when we log on with an incognito browser.
  • We could not find any conditional access policies, and no one had set up any.
  • Tested email connectivity using testconnectivity.microsoft.com (Outlook test). This failed with an error saying that a conditional access policy denied access.

His account definitely had conditional access policies applied but they were hidden, possibly because his O365 license didn’t have Active Directory Premium 2 rights.

We eventually put in a ticket to Microsoft support, and they pointed us in the correct direction.

The issue was a setting under Office 365 Admin Panel.  There is a setting for “Modern Authentication”, that needs to be turned off for some apps that have a different or older Exchange Authentication process.

(Admin center > Settings > Org Settings > Services Tab > Modern Authentication)

This setting can be found in the Admin Panel by clicking “Settings” in the left hand menu panel and then clicking “Org Settings” under the drop down menu.  Then click on “Modern Authentication” in the list of settings.  Toggle to “off”  wait 2 – 3 hours.  

Then to set “App “Password, go under the user My Account, “Security & privacy”, “Additional security verification”, “Create and manage app passwords”.  In older versions of Office 365 the App Password option was in the title banner of the page, in larger font next to “Security Info”.   It is now found by clicking on the “+ Add Method Button”, when available.

Links for O365 Modern Authentication articles by Microsoft:

Microsoft Modern Authentication: https://docs.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication?view=o365-worldwide#enable-modern-authentication-for-your-organization

Exchange MA (includes how to connect with powershell): https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/enable-or-disable-modern-authentication-in-exchange-online

Alternate fix for missing o365 app password

Thanks to Jim Hill for sending these alternate fix steps which worked for him. You can see his original message in the comments. Cheers!

I figured out a solution! I am not sure if these are the exact steps I did. But the root cause was previously having a conditional access policy previously applied to that user.

-Make sure the CA policy for MFA is not enabled. Mine was the Legacy rule, “Baseline policy: Require MFA for admins (Preview)”
-Disable the MFA for that user in the Office 365 Admin.
https://account.activedirectory.windowsazure.com/UserManagement/MultifactorVerification.aspx?BrandContextID=O365
-Create a new CA policy in Azure AD. Have it grant access and require MFA, and only apply just to that user.
-Go back to the Office 365 MFA admin and enable then disable the MFA requirement for that user a few times. I did it four times. Leave with it disabled.
-Return to Azure and remove that user from the CA policy requiring MFA. Leave it enabled but just not applied to any users.
-Return to Office 365 admin and enable MFA for that user.
-Initiate a screen sharing session with that user. Have them log into their MFA set up screen.
https://aka.ms/MFASetup They will then see and be able to create a new app password.

This took me a month to figure out, and my exact steps may not have been exactly as I said above. Hopefully the whole community can figure out the best way.

Where can I manage Office 365 app passwords for multi factor?

how to see or manage app password o365 click account settings

Log on to office.com with the user account that needs an app password

Click on your account icon at the top right corner (normally shows your initials)

Now click My Account

menu for app password displays in account settings o365 user

Click Security and Privacy

Expand Additional Security Verification

Click Create and manage app passwords

create app passwords for a user in account settings o365

From here, you can create your app password.

This is what it is supposed to look like.

cloud IT department migration Office 365 Frederick Baltimore Columbia MD

What you should know about Cloud Computing and Office 365

, , , , , , , , , , , , , 0

Traditionally, if you needed a new server for your business, you bought an expensive piece of equipment, screwed it into a rack, turned it on, and installed the software.

what you need to know about cloud computing

Now we have cloud computing, which makes the server software independent from the equipment.  You could have ten servers worth of software running on one piece of equipment, or you could have the server software running on equipment in someone else’s building!

As a business owner or CIO, you may find that cloud computing is perfect for your business.  Here are some things to know:

 

There are two types of cloud computing; in-house and external.

In-house cloud computing is using a virtualization product like VMWare or Microsoft Hyper-V to separate your server software from the equipment.  You can buy some high quality equipment and run a dozen servers on it.  Cloud computing lets you manage it all centrally and do maintenance on the equipment without having to shut down servers.

External cloud computing is provided by some of the biggest names in technology:  Amazon, IBM, Google, and Microsoft are a few examples.  They have loads of server equipment in huge buildings across the world.  When you create an account with them, you can reserve a specific amount of equipment (such as ten processors and 1,000 GB disk space) and then install your server software onto it.  You will want to set up a connection from your business to your cloud provider (across the Internet), but otherwise the experience will be just like having the servers in your building.

Using cloud computing allows you to rapidly expand or contract your equipment use.

Since cloud computing separates the equipment from your servers, it makes it much easier to add more equipment, re-purpose it, or even remove it depending on your needs.

 

Cloud computing is one of the most efficient ways to have highly-available, redundant servers.

Cloud computing lets servers virtually “migrate” from one piece of equipment to another.  This lets you maintain equipment or even suffer a hardware failure without impacting your servers.

 

Cloud computing saves you facilities costs for power, cooling, space, racks, and cabling.

If you use an external cloud provider, you let them deal with all of the facilities for hosting equipment.  Even if you do cloud computing in-house, you will still see savings because you will be running less equipment than using traditional hardware.

 

Cloud computing lets you keep your IT staff trim

If you use an external cloud provider, your package may include installing software programs, checking backups, and running security patches.  If you do cloud computing in-house, your IT staff will be able to maintain the systems more efficiently using virtualization software.

 

In the long-term, you will still pay for hardware and licensing costs

If you do the math for five years, you will find that cloud computing costs a little more than purchasing your own servers.  But you save on human costs.  Big providers like AWS have really good failover, redundancy, and networking capabilities that small and medium businesses just can’t reproduce.

 

Are you thinking about migrating to Office 365, or AWS, or Microsoft Azure?

You should!  Our clients love their Office 365, and the cloud hosting by AWS and Microsoft Azure are top-notch.  Companies that migrate to AWS or Microsoft hosting have great business continuity and disaster recovery capabilities without even trying.

 

Why choose us?

kieri solutions IT consultant service provider cybersecurity logo

We thoroughly test our solutions, train your staff, and keep your network running..

Kieri Solutions is at our heart a systems engineering company.  We are used to designing and implementing solutions for real companies that want Resilient IT.  At the most basic, this means not breaking your network!  Our senior engineers and systems architects are used to working on critical infrastructure such as nuclear plants, military, and healthcare.  We are very careful.  And we test to make sure everything works before we continue onward.  This means less impact for your users and minimizing the cost to your business from lost work.

We are local, and will be available to support in the future.

When you fly in a consultant from a big name company, you will probably never meet that person again.   In contrast, once we have performed a project for you, we stand by our work and will respond if you have problems later on.   We will also remember you and your network – you won’t be starting from scratch with us.

Our rates are typically half that of a big-name company.

Since we don’t need to fly our employees around, and because we have a smaller footprint, we don’t need to charge crazy rates.  We will be glad to give you a no-risk estimate.

 

 

 

Kieri Solutions provides systems consulting to businesses in Maryland: Frederick, Baltimore, Columbia, Rockville, and other cities in MD!

 

 

For more information, see these awesome articles from PCMag, CIO, and TechRepublic:

http://www.cio.com/article/2901060/cloud-computing/five-basic-things-you-should-know-about-cloud-computing.html

http://www.pcmag.com/article2/0,2817,2330238,00.asp

http://www.techrepublic.com/article/the-state-of-cloud-computing-10-things-you-need-to-know/