I’m working on a UiPath UI automation project where the target application uses Microsoft authentication and MFA is enforced.
The following authentication options cannot be possible due to security policies.:
TOTP-based authentication.
A dedicated bot account with MFA disabled.
Email-based OTP authentication, where the bot retrieves the OTP from a mailbox and completes the login process.
QR code-based setup.
I am provided with Microsoft Azure/Entra credentials, but I am unclear how these credentials can be leveraged in a UI automation scenario. My understanding is that Azure/Entra credentials are primarily intended for API-based authentication mechanisms (OAuth, Client Secret, Certificates, Managed Identity, etc.) rather than interactive browser logins that require MFA.
Additionally, API automation is not an option in this case because the target application does not expose APIs.
I have the following questions:
Can Azure/Entra credentials be used in any way to bypass or satisfy the interactive authentication step for a UI automation scenario?
Are there any recommended authentication approaches for unattended UiPath robots
Has anyone encountered a similar situation, and if so, how was it handled?
Any guidance, best practices, or alternative approaches would be greatly appreciated.
could you explain more about how this MFA is enforced?
like after 1st level authentication(since you mentioned TOTP and email OTP options are not enforced) so i’m assuming you have some sort of desktop app like PING ID that generates a passkey that you need to enter as second level of authentication…
its necessary to understand what is possible, satisfying the security constraints .
The application uses Microsoft authentication. After the user enters their credentials, Microsoft Authenticator MFA is enforced through a push notification. The environment does provide an option to enter an authenticator code; however, automation-friendly approaches such as TOTP-based authentication, email OTP, QR-code enrollment, or using a dedicated account with MFA disabled are not permitted due to security policies.
We have been provided with Azure/Entra application credentials (Application ID, Tenant ID, and Client Secret), but my understanding is that these credentials are intended for application-to-application authentication (OAuth/API scenarios) rather than interactive browser-based user authentication.
Since the business functionality we need to automate is only available through the UI and no API is exposed for that operation, we are trying to understand whether there is any supported approach for an unattended UiPath robot to handle this authentication flow while remaining compliant with the security requirements.
you are good with Microsoft platform applications since you can use GRAPH with OAuth to access all MS apps. but the challenge is with the 3rd party/in-house apps that use MS MFA.
so basically, the 1st level authentication happens on Microsoft, if successful it generates a token which will then be passed to target application which then invokes a push notification for 2nd level auth.
mmm… interesting how an org level changes are made without considering the challenges for automation..
let me do some digging…
one more question, where does this push notification appear?
phone ?
Hi @Kshitij_Sonawane
Yes, the push notification comes to the user’s mobile phone through Microsoft Authenticator.
The main challenge is that an unattended UiPath robot cannot approve the MFA notification by itself because it requires human action on the phone.
Since TOTP, email OTP, MFA bypass, and dedicated non-MFA accounts are not allowed, there is currently no supported way for the robot to complete the login automatically.
We are checking with the application and security teams to see if there is any approved automation-friendly authentication method available.
cool…
my advice would be to propose a solution that uses a API enabled token generation solution so that your robots dont rely on these application UI for passkey..
Thank you for the suggestion. We have evaluated API-based authentication options; however, the business functionality we need to automate is not exposed through APIs and is currently only available through the application’s UI.
I would recommend discussing the use case with the security and application teams to determine whether an approved automation-friendly authentication mechanism is available, such as SSO, a service account, or a policy specifically designed for unattended automation.
SSO may be a viable option, depending on the organization’s authentication and Conditional Access policies. The security team should be able to advise whether there is an approved approach for unattended automation that remains compliant with security requirements.
The application is a third-party web application. The initial approach was to use API automation, and Azure application credentials were provided for that purpose. However, some of the required business functionalities are not exposed through APIs and are only available through the UI, which is why we are exploring UI automation.
I will review the Two-Factor Authentication Activities package as well. Thank you for your input.