Skipping MFA setup within trusted IP range

[chrisjako]

Does anyone know if its possible to skip the MFA setup from within my trusted IP range?

 

Basically I want all users to have MFA however I only want Office365 to prompt them to set this up when they are outside of my trusted IP range

[atcoates]

Yes it is possible within Office 365 but not sure if works on all licences?

 

Help here https://www.bettercloud.com/monitor/the-academy/how-to-whitelist-ip-addresses-for-multi-factor-authentication/

[chrisjako]

Yes it is possible within Office 365 but not sure if works on all licences?

 

Help here https://www.bettercloud.com/monitor/the-academy/how-to-whitelist-ip-addresses-for-multi-factor-authentication/

 

Yes I have this setup already, what it doesn't do is skip the setup process entirely, its still mandatory to setup MFA and once its set it will not ask again - I don't want this to happen, I only want Azure to require MFA setup when the user it outside our trusted IP scope

[synaesthesia]

Surely that's by design, once it's set up it's done, and that's best done on site when tech support is available if they get stuck.

[chrisjako]

Here is the issue with that

 

1) Some teachers refuse to use their personal device to authenticate their office365 account and therefore will not access office365

2) Some users do not have a mobile device or access to a phone to complete the request

3) I need to set this up for students, or SLT do not allow use of phones within class

 

What's happening at the moment is our homepage is set to sharepoint online with SSO, students cannot access the homepage or their office365 experience just because they cannot setup MFA (for whatever reason, some have managed it but a majority haven't)

 

It would by great if i could bypass the setup process from my trusted IP range, its useless anyway since it is bypassed - Surely asking the user to setup MFA when outside the trusted scope is a better method of forcing them to setup whilst in a trusted scope

[PlantHead]

Ask them to use SMS or an alternative email account as their 2nd form of authentication.

I don;t think there is a way to do what you want.

 

Here is the issue with that

 

1) Some teachers refuse to use their personal device to authenticate their office365 account and therefore will not access office365

2) Some users do not have a mobile device or access to a phone to complete the request

3) I need to set this up for students, or SLT do not allow use of phones within class

 

What's happening at the moment is our homepage is set to sharepoint online with SSO, students cannot access the homepage or their office365 experience just because they cannot setup MFA (for whatever reason, some have managed it but a majority haven't)

 

It would by great if i could bypass the setup process from my trusted IP range, its useless anyway since it is bypassed - Surely asking the user to setup MFA when outside the trusted scope is a better method of forcing them to setup whilst in a trusted scope

[synaesthesia]

It's just set up on the next login whereever they are. The only way around that would be to enable it before the end of the day and tell them not to log in until they get home. Still think it's daft though, the other problems are procedural; if people don't want to abide then it's their problem - the school have to protect their data and their staff, its of their benefit.

[chrisjako]

Ask them to use SMS or an alternative email account as their 2nd form of authentication.

I don;t think there is a way to do what you want.

 

looking at MFA service settings alternative email is not available:

 

 

Methods available to users:

 

Call to phone

 

Text message to phone

 

Notification through mobile app

 

Verification code from mobile app or hardware token

[synaesthesia]

Foot down time. "If you don't want to use a personal device whether its a phone or tablet for this purpose, then you'll not be able to use services outside school. Please remember that school is locked up at 7pm to help with the extra workload."

[PlantHead]

Strange I wonder if it is to do with licensing, these are the authentication methods I have available.