Issues with MFA for some tenants

[RickardN-CRMK]

In some tenants I get an error when trying to authenticate using dataverse-auth@2.
The error is
Authentication failed: InteractionRequiredAuthError: invalid_grant: AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access ''. Trace ID: 251019fc-a6d8-4dbe-9c46-2d6299850000 Correlation ID: 94d7951c-d817-455e-ad91-71cbebc1dfd3 Timestamp: 2025-09-23

I don't get an MFA prompt for these tenants.

I can authenticate using MFA with that account everywhere else and I can authenticate with other tenants (and obviously accounts) with dataverse-auth@2.

(also tried with device code but that's not allowed either and I haven't found anything on what is needed on the Azure side to allow it, but it would really be nice to have the mfa working)

[RickardN-CRMK]

Update with more info. The login request is getting blocket by conditional access in Azure with the message "Device browser
Rich Client 1.18.4". I'm guessing that there is a setup where only known browsers are allowed. Would it be possible to use the default browser with electron instead of BrowserWindow

[mrmwink-wtwco]

I am facing what I believe is the same issue, MFA is enabled but we can't use the device-code route used previously as this is now disabled in this instance.

Do you know of any other suggestions?

[daryllabar]

This worked for me:

Use the Device Code Flow
If the standard Electron login window is failing to trigger the MFA prompt, you can force a different authentication method that uses your actual web browser (where MFA is easier to complete).

Open your terminal.

Run the following command: npx dataverse-auth [your-org-url] device-code (e.g., npx dataverse-auth myorg.crm.dynamics.com device-code).

The terminal will provide a code and a URL (usually https://microsoft.com/devicelogin).

Open that URL in your regular browser, enter the code, and complete the MFA challenge there.

Once successful, the terminal will save the new token to your local cache, and Dataverse-ify should work again without the error.

[mrmwink-wtwco]

Unfortunately device flow is disabled in my org, but I did find a way to get standard logon to work after working with my corporate IT team, all I had to do was register configure my Microsoft Authenticator app to allow "passwordless access", doing so now means when I run dataverse-auth I get a auth request pp up on my mobile phone which I can approve and that works just fine