Error on creating a Service Connection from Azure Devops to Portal subscription

This seems to be because you haven't setup MFA as per the mandatory MFA policy requirement for admins.

Are you doing this via console? If yes, you might need to try via the portal first or create a MFA exclusion

Microsoft enforces mandatory MFA for all accounts accessing the Azure and Entra portals. You cannot bypass this globally, as skipping MFA challenges is restricted. To log into the console without MFA, you must create an account and exclude it via Conditional Access Policies, which requires an Entra ID P1/P2 license.

Steps to Configure MFA Exclusions:

Get an Entra ID License: Upgrade your directory to Microsoft Entra ID P1 or P2.

Turn Off Security Defaults: Because Security Defaults block exclusions, log into the Microsoft Entra admin center, navigate to Identity > Overview > Properties, and select Manage security defaults. Set the toggle to Disabled.

Create an Excluded Group: Go to Groups > New group and create a group for users (e.g., "MFA Excluded Users"). Add your new account to this group.

Create a Conditional Access Policy: Navigate to Protection > Conditional Access > Policies > New policy. Name your policy, assign it to All users, then go to the Exclude tab to select your "MFA Excluded Users" group. Under Access Controls, set it to grant access without requiring MFA.

Hope this helps,

Hello Michael Sinoplis,

Thanks for confirming the Owner role on the subscription. This rules out a standard RBAC issue — the error you're seeing is related to Azure's Conditional Access / MFA claims requirement on management operations, not your assigned permissions.

Since 2024–2025, Azure enforces MFA on all resource management write operations (including role assignments) at the tenant level. This check is independent of RBAC roles. Even with Owner access, if the authentication token used for the operation doesn't carry an MFA claim, Azure blocks the request. This typically happens when:

• The session was established from a cached login (no fresh MFA challenge)
• The account falls under a Conditional Access trusted location/exclusion
• A PIM-eligible role was activated without a fresh MFA prompt

Recommended Steps

1. Re-authenticate with a fresh MFA session Sign out of all Microsoft sessions in the browser (or use a private/incognito window), then sign in again at portal.azure.com and confirm you receive an MFA prompt. Immediately retry the service connection creation in Azure DevOps using the same browser session.
2. If Owner access is granted via PIM Deactivate and reactivate the role, ensuring MFA is explicitly prompted during activation.
3. Verify Conditional Access configuration Have your Entra ID administrator check the sign-in logs for the failed request and confirm whether the authnmethodsreferences claim includes mfa. If the account is excluded from the relevant MFA Conditional Access policy, or is signing in from a trusted/excluded network, that exclusion will need to be adjusted for this scenario.
4. Workaround for unattended/non-interactive accounts If this account cannot complete interactive MFA (e.g., a service account), bypass the automatic role assignment:
   • Manually create the App Registration/Service Principal in Entra ID.
     • Assign the required role using Azure CLI from a session with completed MFA:

     az role assignment create --assignee <appId> --role Contributor --scope /subscriptions/<subscriptionId>

• In Azure DevOps, configure the service connection using Service Principal (manual) instead of (automatic), and provide the existing credentials directly.

Reference

https://aka.ms/MFAforAzure

Please confirm if a fresh MFA sign-in resolves the issue, or share what the sign-in logs show if the problem persists.

Michael Sinoplis I’m following up on my previous comment as I haven’t received a response. Please let me know if you need any additional information or assistance from my side.  

@Michael Sinoplis
I’m following up on previous comment as we haven’t received a response. Please let me know if you need any additional information or assistance, we are happy to help further.