Ascendant Authentication headaches

Microsoft’s published authentication stack for work/school accounts centers on Microsoft Authenticator (passwordless and app verification), Microsoft Entra ID admin‑consent workflows, and the Power Automate approvals connector, not a named product called “Ascendant Authentication.” (learn.microsoft.com) The Entra admin‑consent workflow is an explicit feature that creates a request queue, sends reviewer email notifications, and lets admins approve or deny application permission requests from the Entra admin center. (learn.microsoft.com) Microsoft Q&A threads document real-world cases where an admin consent request appears to be approved by a reviewer but OAuth flows remain stalled, requiring manual follow‑up or tenant configuration changes. (learn.microsoft.com) Microsoft’s Power Automate approvals connector includes a documented “split create and wait” failure mode that can leave approvals stuck in pending state when the flow structure separates the Create an approval and Wait for an approval actions. (learn.microsoft.com) Microsoft made tenant‑consent changes effective July 16, 2025, and Microsoft’s guidance since then has urged tenants to enable the Admin Consent Workflow and tighten user consent settings to prevent unintended tenant‑wide app access. (blog.interian.be) Practical configuration steps published by Microsoft include enabling the admin consent workflow, assigning multiple reviewers, restricting user consent by permission class, and using user or group assignment to keep apps from receiving tenant‑wide access. (learn.microsoft.com) Security researchers recommending defenses against AiTM phishing attacks specifically call out FIDO2 hardware tokens and passkeys as more AiTM‑resistant than notification‑based MFA, and Microsoft documents FIDO2/passkey and Microsoft Authenticator passwordless options. (logstail.com) Microsoft’s service‑status pages and third‑party monitors show hundreds of Microsoft 365 incidents tracked since mid‑2023 (266 incidents reported by one tracker), underscoring why single‑admin approval bottlenecks and workflow bugs translate directly into measurable helpdesk load during service or workflow faults. (azure.status.microsoft)