Return
-
Title
User receives error message "Invalid token response, enter a valid token response" when attempting to authenticate with two-factor authentication -
Description
The user is attempting to authenticate with 2FA using their Active Directory password and then their token code.
When the user enters the correct username and password, they are presented with the message "Invalid token response, enter a valid token response".
However, once they enter their token code authentication is successful. -
Cause
The Access Policy assigned to the user may only be configured to require one form of authentication.
If this is true, then the error message occurs because Defender is expecting a token code and not a password. That is why it works upon the second try. -
Resolution
Modify the Access Policy to require two steps of authentication.
This can be done within the Defender Administration Console.
Navigate to the Policies OU and open the relevant policy.
Confirm the below settings:
Use: Active Directory password
Followed By: Token