How do I configure my Azure AD account to use LastPass MFA for authentication?

You can configure both your Azure Active Directory account and LastPass Business account so that the LastPass Authenticator app can be used for authentication when you log in to any single sign-on app where you use your Azure Active Directory account.

Note: This feature requires an account with the LastPass Business + Advanced MFA add-on. How do I upgrade my LastPass Business account with an add-on?

Account requirements

A Premium tier subscription to Microsoft Azure Active Directory (required for use of conditional access – learn more)
An active trial or paid LastPass Business + Advanced MFA add-on account
An active LastPass Business + Advanced MFA add-on admin (required when activating your trial or paid subscription)

Set up and configure

Note: Policies are not enforced by LastPass in this configuration. All policies have to be configured in Azure AD using Conditional Access policy (for example, location restriction, biometrics, and so on).

Before you begin: Open a text editor application, which will be used in later steps to save copied values.

Add the Microsoft Azure AD app.

Log in with your email address and master password to access the new Admin Console at https://admin.lastpass.com.
If prompted, complete steps for multifactor authentication (if it is enabled for your account).
Select Applications > MFA Apps.
If you have not previously added MFA apps, select Get started. Otherwise, select Add app in the upper-right navigation.
Select Microsoft Azure AD > Save & continue.

Save the integration key and integration secret.

Optional: On another web browser window or tab, you can open your LastPass vault and create a new secure note for saving the integration key and integration secret.
In the Set up integration window, copy and save the integration key to your clipboard, then paste it into your text editor application, that is the Client ID.
Click Finish.
Copy the JSON below and paste it into your text editor application. Replace < your unique Client ID > with the Client ID value you pasted earlier into your text editor application.

{

"AppId": "002a1c97-1381-4f73-a9c9-c049e8ef3a82",

"ClientId": "<your unique Cliend ID>",

"Controls": [

{

"ClaimsRequested": [{"Type": "amr","Value": "2fa","Values": null

}],

"Id": "LastPassIdentityMFALogin",

"Name": " LastPass Identity MFA Login "

}

],

"DiscoveryUrl": "https://identity.lastpass.com/oauth/.well-known/openid-configuration",

"Name": "LastPass Identity MFA"

}

Configure Conditional Access for Azure AD.

Sign in to your Azure AD account at https://portal.azure.com.
Go to Azure Active Directory > Security > Conditional Access.
Select Custom controls.
Select New custom control.
Copy the JSON from Step #9 above, then paste it in the custom control window.

Note: You must include your unique Client ID.
Select Create > New Policy.
Enter a name for your policy (for example, LastPass Multifactor Authentication).
Select Users and groups, then select your desired users and groups (for example, All users).

Tip: To avoid being locked out as admin when setting Conditional Access, create a test AD group that does not include admins.
Select Cloud apps or actions, then select the cloud application(s) for which you want to require Multifactor Authentication using the LastPass Authenticator app (for example, All cloud apps).
Under Access controls, select Grant.
Select the Grant access option.
Check the box to enable the LastPass Identity MFA Login option.
When finished, click Select.
Under the "Enable policy" section, toggle the switch to On.

Important: If you want to edit or delete the integration later, disable conditional access on Azure before applying any changes in LastPass.
Select Create.

Result: You have completed the setup steps in the Azure AD portal, and your users are now required to use the LastPass Authenticator app for authentication.

Send the LastPass Authenticator app activation email to users.

Send an activation email to all users who haven't already activated their account to use the LastPass Authenticator app (instructions here).
Result: A new activation email is sent to all required users with instructions on how to activate passwordless authentication.

Results: Going forward, when your users log in to Azure AD SSO with their Azure AD account password, they will be prompted to authenticate using the LastPass Authenticator app.

Figure 1. iOS LastPass Authenticator push notification on iOS

Figure 2. Android LastPass Authenticator push notification on Android