EntraID Proxy and Temporary Access Passwords

[Rhian Resnick]

Good morning,

We are looking at enabling MFA in Entra ID and using Temporary Access Passwords (TAP), unfortunately Entra is denying authentication requests from Shibboleth because the authentication method for TAP doesn't match the requested authentication method. (Authncontextclassref) Error - AADSTS75011


They (MS) recommend forcing the SP to not send the RequestedAuthnContext value in the request as it is optional, but I wanted to see what the rest of the Shibboleth group thought about this and if they are doing so how.




 https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/app-integration/error-code-aadsts75011-auth-method-mismatch



Rhian Resnick

Director, Research Computing

Office of Information Technology

Florida Atlantic University

561 297 2647


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250721/26d451e5/attachment.htm>