After a long struggle of troubleshooting and investigation, I found the solution for this issue, and posting it here, so it may be helpful to others.
While implementing MFA in out SharePoint site, it is expected that all our SharePoint user accounts should be in sync with Azure AD, however our existing accounts not actually Azure Identities, they are originally windows identities.
While setting the permission in SP site, we used to give the email ID / username of the user and it will get resolved to their windows identity format : contoso/firstname.lastname,
Whereas Azure AD account seems to be a different one, it contains the full email ID like [email protected]
I've replace the user account to Azure AD identity in the SharePoint group to resolve the issue.
Note:
Azure accounts has a set of 5 entities and we need to add all of them in the SharePoint groups, as follows.
• Azure AD name
• Azure AD GivenName
• Azure AD SurName
• Azure AD Email
• Azure AD Role