Entra: the auth requirement is about this sign-in

The field is this event

A sign-in can record whether that event required a single factor or multiple factors. The value is about this row. It is not an inventory of authentication methods stored on the account, and it is not the tenant’s policy list.

A single-factor value means this sign-in was not required to use a second factor. It does not mean the account has no second factor registered. A multi-factor value means this sign-in required more than one factor. It does not name which method succeeded unless another field on the same row says so.

Policies stay on their own entries

Each Conditional Access policy still has its own result. The requirement field does not replace that list. If you say a policy caused the requirement, quote the policy entry. If the list does not show that, write that the link is not on the row.

Do not disable an account because this field says single factor. A disable needs the note from the disable lesson, not this one field.

What to file

File the sign-in id, the requirement value as printed, and any method detail that is actually on the row. If method detail is absent, say so. Do not add the account’s registered methods from a different screen and present them as part of this sign-in.

Worked case: single factor read as “no MFA on the account”

Sign-in c3 shows authenticationRequirement singleFactorAuthentication for riley@hackblue-lab.org, user id u-100. A draft says the account has no MFA methods and should be disabled. The methods screen was not opened. The policy list on this row was not quoted.

The note quotes the requirement as what this sign-in required. It says registered methods were not in the row. It does not disable the account. A later look at the methods screen, if someone does it, is a different source with its own time.

Snippet

sign-in: c3  userId: u-100
authenticationRequirement: singleFactorAuthentication
methods registered on the account: not in this row
policy entries: not quoted here
write: this sign-in required one factor
not: the account has no MFA, and not a disable

Diagram

What the requirement field can and cannot say

It describes this sign-in.

single factor on the row
This sign-in did not require a second factor.
multi-factor on the row
This sign-in required more than one factor. Methods only if another field names them.
Not the methods screen
Registered methods are a different page.
Not a disable
This field alone is not a reason to disable the account.

Check yourself

1. authenticationRequirement says single factor. What is established?

2. You want the methods registered on the account. Where is that?

3. A policy entry is not quoted, but you think it forced MFA. What do you write?