title: How to handle MsalUiRequiredException after AcquireTokenByAuthorizationCodeAsync
body: <p>We have recently implemented some conditional access policies that require multi-factor authentication for certain applications.  One of those policies forces CA on some datasets that are also exposed through Graph, so specific Graph scopes now require multi-factor authentication.</p>
  
  <p>I'm struggling with how to handle this scenario in a .Net web app using the MSAL v3 preview library. My web app itself does not fall under the CA policy, but it's attempting to request a graph scope that does.</p>
  
  <p>When configuring authentication, I'm passing all the graph scopes that are required by the application:</p>
  
  <pre><code>app.UseOpenIdConnectAuthentication(
      new OpenIdConnectAuthenticationOptions
      {
          ClientId = ClientId,
          Authority = Authority,
          RedirectUri = RedirectUri,
          Scope = "openid profile offline_access " + GraphScopes,
          PostLogoutRedirectUri = postLogoutRedirectUri,
  </code></pre>
  
  <p>That authentication flow does not force the user to MFA.  The next step is the AuthorizationCodeReceived event.  In there I'm creating a token cache and attempting to obtain a token via the authorization code:</p>
  
  <pre><code>var code = context.Code;
  string signedInUserId = context.AuthenticationTicket.Identity.FindFirst(ClaimTypes.NameIdentifier).Value;
  
  TokenCache userTokenCache = new MSALSessionCache(signedInUserId, context.OwinContext.Environment["System.Web.HttpContextBase"] as HttpContextBase). GetMsalCacheInstance();
  
  ConfidentialClientApplication cca = new ConfidentialClientApplication(ClientId, Authority, RedirectUri, new ClientCredential(AppKey), userTokenCache, null);
  string[] scopes = GraphScopes.Split(new char[] { ' ' });
  AuthenticationResult result = await cca.AcquireTokenByAuthorizationCodeAsync(code, scopes);
  </code></pre>
  
  <p>The AcquireTokenByAuthorizationCodeAsync method is the one that throws an exception - MsalUiRequiredException.  The exception includes claims that I'm assuming need to somehow be used to force MFA.</p>
  
  <p>That's where I've hit a roadblock.  What do I do with those claims?  I've seen some documentation indicating that I should use them as extraQueryParameters when requesting a token, but I have yet to find a method that would allow me to do that.  I found a method on the ConfidentialClientApplicationBuilder class that allows me to specify claims, but I still receive MsalUiRequiredException.</p>
  
  <p>For now my solution has been to add my web app to the original Conditional Access policy.  That forces MFA on the front-end of the auth flow and satisfies Graph.  To me that seems like an unnecessary step.  I should be able to handle the error in my web app and force the MFA programmatically.</p>