O365 2FA Global Admin Dilemma

[foofighterjim]

So I have just enabled 2FA on our global O365 admin account however this provides a bit of a logistical issue. All of the 2FA options appear to assume only one person is in charge of this account i.e. texting / calling a number or using the app, however there are 3 of us that use this account when we need higher privileges than our standard accounts. The code is currently set to be sent to my mobile but this is of no use to the others unless I am in the office at the same time or am able to promptly forward the message on. I did note the ability to call the schools number but this would get the call as far as reception and not to our office and I'm not sure how it will respond to being redirected to our extension (we don't have a direct number), although something I may now enquire about. I know that I could elevate all 3 of our accounts to be global admins but I am not stuck on the idea of doing this. Is it possible to create a Security & Compliance rule for the Global Admin to not require 2FA if the request is coming from our Office? How do the rest of you that work in teams do it?

[ZeroHour]

It may be worth having 3 global admin accounts that are assigned to each person? That way normal accounts are not elevated and you can each manage each individual global admin account. You would then have logs showing who changed what and you can then use Microsoft Authenticator on each phone if you wanted.

[foofighterjim]

Just found the Conditional Access section in Azure AD, need Azure AD Premium to use it

 

It may be worth having 3 global admin accounts that are assigned to each person? That way normal accounts are not elevated and you can each manage each individual global admin account. You would then have logs showing who changed what and you can then use Microsoft Authenticator on each phone if you wanted.

 

Now there's an idea! Definitely a simple solution (which is always a big plus in my book).

Edited November 28, 2017 by foofighterjim