Step-up Authentication

Some GrantFlow actions need a stronger sign-in than the one you started your session with. Today these are:

• Creating a SIEM feed token. The token reads your tenant's whole audit log.
• Changing the step-up setting itself. A weaker session must not be able to change what GrantFlow asks for.

When your session is not strong enough, GrantFlow asks Entra ID for a stronger sign-in. If you configure a Conditional Access authentication context, this happens in place: Entra ID asks only for the missing factor, often silently, and the action continues. Without a context, GrantFlow asks you to sign in again and choose a strong method yourself.

This guide is for administrators. It takes you through the one-time setup in Entra ID and in GrantFlow.

Which sign-ins count as strong

GrantFlow checks how you actually signed in, from the sign-in methods Entra ID records in your token. It does not take a Conditional Access result on trust, and it only counts a method that Entra ID names explicitly.

Sign-in method	Strong enough
Passkey or FIDO2 security key	Yes
Windows Hello for Business	Yes
Multifactor certificate-based authentication	Yes
Microsoft Authenticator (push, passwordless phone sign-in or code)	Yes, when Entra ID names the method in the token
Hardware OATH token	Yes, when Entra ID names the method in the token
SMS, voice call or email one-time code	No
Temporary Access Pass	No
Password alone, certificate alone, or Windows integrated sign-in alone	No

A passkey, security key or Windows Hello sign-in always counts. For the other strong methods, a weak method in the same session cancels them out: a session that combines Authenticator push with an SMS code or a Temporary Access Pass does not count, even though Entra ID calls it multi-factor.

Authenticator push may not be named yet

Some tenants still record a password-plus-Authenticator sign-in only as generic multi-factor authentication, without naming the method. GrantFlow cannot tell such a session apart from password plus SMS, so it refuses it. If this happens in your tenant, sign in with a passkey or Windows Hello for Business, or require phishing-resistant MFA in the Conditional Access policy below so the step-up asks for one.

Before you start

You need:

• Microsoft Entra ID P1 (or higher), which Conditional Access requires.
• A Conditional Access Administrator (or Security Administrator) for the Entra ID steps.
• A GrantFlow administrator who can sign in with one of the strong methods above. Saving the setting needs a strong sign-in itself.
• A phishing-resistant method for everyone the policy covers, such as a passkey, a FIDO2 security key, Windows Hello for Business or multifactor certificate-based authentication. The recommended policy in step 2 requires one, so it is stricter than GrantFlow's own check.

No app registration change

You do not change any app registration or grant any new consent. GrantFlow asks Entra ID for the authentication context in the sign-in request itself, only when an action needs it. The authentication context and the policy below are the only things you create.

1. Create an authentication context

1. In the Microsoft Entra admin center, open Protection → Conditional Access → Authentication contexts.
2. Select New authentication context.
3. Give it a name, for example GrantFlow step-up, and a description.
4. Select Publish to apps, so applications can request it.
5. Note its ID, c1 to c25. You enter it in GrantFlow in step 3.

2. Create the Conditional Access policy

Create a new Conditional Access policy:

• Users: the GrantFlow administrators. All users also works, because only the actions above ask for the context.
• Target resources: select Authentication context and pick the context from step 1.
• Grant: Require authentication strength → Phishing-resistant MFA.
• Session (optional): Sign-in frequency → Every time, so a step-up prompts again rather than reusing an older strong sign-in. Entra ID still applies a five-minute prompt tolerance, so a step-up within a few minutes of a strong sign-in can reuse it without a new prompt. Do not treat this setting as a guarantee of reauthentication for every action.
• Enable policy: On.

Two different checks

The policy and GrantFlow check different things. The Phishing-resistant MFA strength accepts methods such as a passkey (including one held in Microsoft Authenticator), a FIDO2 security key, Windows Hello for Business or multifactor certificate-based authentication. Authenticator push, phone sign-in or codes and hardware OATH tokens pass GrantFlow's check in the table above, but they cannot satisfy this policy, so administrators who only have those methods cannot complete the step-up. Register a phishing-resistant method for them before you enable the policy.

A context without a policy proves nothing

Entra ID issues a context even when no policy targets it. GrantFlow therefore never treats the context as proof of a strong sign-in: it always re-checks the sign-in methods. A missing or weaker policy weakens nothing, but the step-up then cannot help either. You will see the "needs a stronger sign-in" error again after the prompt.

GrantFlow never creates or changes Conditional Access policies. It only asks Entra ID for this context when an action needs a stronger sign-in.

3. Enter the context in GrantFlow

1. In GrantFlow, open Audit & Compliance → Step-up.
2. Enter the context ID from step 1, for example c1.
3. Select Save.

Saving is itself protected by the step-up. If your current session is not strong enough, GrantFlow asks for a stronger sign-in before it saves. The first time, no context is configured yet, so you are asked to sign in again with a strong method.

To remove the setting, select Clear and confirm. GrantFlow then falls back to asking for a fresh sign-in.

What users see

With a context configured:

1. GrantFlow first asks Entra ID for the context silently. If you already signed in strongly enough, the action continues with no prompt.
2. Otherwise GrantFlow shows Verify with your passkey. Selecting it opens a small Entra ID window that asks only for the missing factor, then closes, and the action continues.

Without a context, GrantFlow explains which methods qualify and offers Sign in again. This opens an Entra ID sign-in window in which you choose a strong method yourself.

Either way, the refusal and the successful attempt are recorded in the audit log. Changes to the step-up setting are recorded as tenant.step_up.update.

Troubleshooting

Symptom	What to check
"Needs a stronger sign-in" appears again right after the passkey window	Check that a Conditional Access policy targets the context in GrantFlow's Step-up setting and requires a phishing-resistant authentication strength. Without the policy, Entra ID does not ask for a stronger factor.
The passkey or sign-in window does not open	The browser blocked the pop-up. Allow pop-ups for GrantFlow and select the button again.
The window opens for the wrong account	Close it and sign in with the account you use in GrantFlow. GrantFlow refuses a sign-in for a different account.
Every step-up asks for a full sign-in	No context is configured. Complete steps 1 to 3.
Authenticator push or codes are refused	Your tenant may still report these as generic multi-factor authentication or a generic one-time code, which GrantFlow cannot tell apart from SMS. Use a passkey or Windows Hello for Business instead.