Microsoft Phishing-Resistant MFA failing in Teams App

JiveCatDaddyO

Hello, friends: I have just installed GrapheneOS on my Pixel 6a and am very impressed.

However, my work requires that I configure Microsoft Teams, and we have Phishing-Resistant MFA enabled in our Microsoft Tenant (https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-admin-phish-resistant-mfa). This requires me to use a FIDO Yubikey to authenticate to Microsoft services. I can authenticate successfully to login.microsoftonline.com via Vanadium: however, the Teams and Outlook apps fail. I get a prompt to use 'Face, fingerprint, PIN or security key', but then it appears that the app is failing to invoke the OS' handling of the key? When logging in via Vanadium, at this point I get what looks to be an OS alert to 'Connect my security key'. This never shows in Teams and appears to fail silently.

I have done some research on the forums already, and I have installed sandboxed Google Play and Microsoft Authenticator, opened the apps, and rebooted the phone. Any pointers or help is greatly appreciated! Thank you!

fid02

JiveCatDaddyO

I can confirm the problem on GrapheneOS. It works on stock PixelOS.

GrapheneOS 2025012700
Play services 24.50.34
Gmscompatconfig 153
Pixel 6a

Stock OS AP4A.250105.002
Play services 24.50.34
Pixel 8

Note that an authentication broker is necessary for signing in to most Microsoft apps with FIDO2. You need either Company Portal or Microsoft Authenticator installed in the profile so that Teams, Outlook, etc. can communicate with the broker app. More information.

On stock PixelOS, when you open Teams and enter your email, a small, barely visible, popup will appear with the option "View options". When selected, the standard FIDO UI from Play services appears. On GrapheneOS this popup does not appear, instead the app redirects you to select the "Face, fingerprint..." option, which yields the same result.

It looks like something's failing during communication with the broker app. I found this in the Teams app logs after reproducing the issue; perhaps it's relevant:

01-29 16:04:56.024 7622 7766 E OneAuthLog: [OneAuth:0002:Error::00000000] [Common] [2025-01-29 16:04:56 - thread_id: 161, correlation_id: UNSET - Android 35] Broker Result not returned from Broker 01-29 16:04:56.024 7622 7766 E MsalBrokerResultAdapter:brokerResultFromBundle: [2025-01-29 16:04:56 - thread_id: 161, correlation_id: UNSET - Android 35] Broker Result not returned from Broker

fid02

fid02 On stock PixelOS, when you open Teams and enter your email, a small, barely visible, popup will appear with the option "View options". When selected, the standard FIDO UI from Play services appears. On GrapheneOS this popup does not appear

Looks like this is not exclusive to Microsoft apps. Observing the exact behaviour with Discord, which as far as I know doesn't rely on a broker.

These two apps have in common that they don't call the default web browser when the user wants to use passkeys. Can't think of other apps to test right now. Some apps support passkeys but not with security keys, so will need to be compared with how each app behaves on stock OS.

fid02

Will test when the next OS release is in alpha: https://xcancel.com/GrapheneOS/status/1884343438360863158#m

fid02

fid02 Will test when the next OS release is in alpha:

Same behaviour on 2025020200.

JiveCatDaddyO

Thank you so much for all your hard work on this!

faaaaaj

im having a simmilar issue. i can use my password manager passkeys in vanadium, but not physical ones?
im so confused

fid02

faaaaaj im having a simmilar issue. i can use my password manager passkeys in vanadium, but not physical ones?
im so confused

That is a different topic. This topic is about Microsoft's apps, in which passkeys on hardware keys can currently only be used if your account is enrolled in Entra ID. I suggest you start a new topic.