Is Entra PIM’s Authentication Context Bypassable with Certain Browsers?

Are you sure that you're actively enforcing the authentication context with a Conditional Access policy? I had a similar situation where the policy didn't seem effective because the UI wasn't properly showing its status. Also, checking the sign-in logs or the browser's developer tools might give some clues about what's going wrong.

Honestly, I believe the best approach with PIM is to stick to strong conditional access policies instead of relying on authentication contexts. It minimizes headaches down the line. We implement CAPs to enforce strict authentication for certain accounts and use authentication contexts to add an extra layer against on-device hijacking.

I did a quick check and noticed that with Brave, there’s no prompt for reauthentication. It’s concerning that browser choice can impact authentication.

Have you considered blocking unknown browsers? It might help with some of these issues.

I completely get where you're coming from with your concerns. We try to combine various measures like PIM approver requirements and advanced detections to reinforce security while making sure legit users aren’t affected. We have to prevent privilege escalation but without causing too much friction for everyone else.