Azure AD B2C按用户配置MFA：条件访问策略为何不生效？

Great question—this is a super common point of confusion between regular Azure AD and Azure AD B2C, so let’s break this down clearly:

First, let’s set the record straight: Conditional Access Policies (CAP) work differently in Azure AD B2C compared to standard Azure AD tenants. In B2C, CAPs only protect tenant management resources (like the B2C admin portal or Graph API access for user management) — they have zero impact on the MFA trigger logic for end-users logging into your apps via user flows. This isn’t a UI bug or configuration mistake; it’s a deliberate design limit. The Multifactor authentication -> MFA enforcement setting in your user flows is the only native global control for MFA during end-user sign-ins (without custom policies).

When you create a CAP in a B2C tenant, its scope is strictly for administrative operations, such as:

• Restricting which admins can access the B2C portal
• Requiring MFA for admins calling the B2C Graph API
• Blocking administrative access from specific regions

It never interferes with the end-user authentication flow through your user flows. No matter how you target individual users in your CAP, it won’t change whether they’re prompted for MFA when signing into your app.

If you want to let users choose whether to enable MFA for their accounts, there are two main paths forward. One requires custom policies (which you want to avoid, but it’s the most robust option), and the other is a workaround with limitations:

Option 1: Use Custom Policies (Recommended, Most Flexible) #

This is the officially supported method for per-user MFA control in B2C:

1. Create a custom user attribute in your B2C tenant (e.g., IsMFAEnabled, a boolean type) and build a profile management flow where users can toggle this setting on or off.
2. Add claims transformation logic to your custom policy that reads the user’s IsMFAEnabled attribute.
3. Dynamically trigger the MFA step only when the attribute is set to true by routing the user to the MFA claims provider conditionally.

Option 2: Workaround (No Custom Policies, But Limited) #

If you’re set on avoiding custom policies, you can use a combination of user attributes and risk-based MFA:

1. Create the same IsMFAEnabled custom attribute for users to toggle.
2. Use Azure AD B2C Identity Protection to manually mark users with IsMFAEnabled=true as "high risk" (you can automate this via Graph API if needed).
3. Set your user flow’s MFA enforcement to Conditional (risk-based), so high-risk users (your opt-in MFA users) are prompted for MFA.

Note: This workaround is clunky — users won’t see a direct "enable MFA" toggle, and you’ll need to sync attribute changes to risk levels. It’s far less intuitive than using custom policies.

• Your conditional access policy isn’t working because B2C CAPs don’t affect end-user sign-in MFA — that’s by design.
• There’s no fully native, no-code way to let users choose their MFA status without custom policies right now.
• For the most reliable and flexible solution, custom policies are the way to go. The risk-based workaround is a viable alternative only if you’re willing to accept its limitations.

内容的提问来源于stack exchange，提问作者Markus S.