How to Setup MFA for pilot group of users in office 365

[mrstrong]

Hi,

 

we are on office 365 A1 Plus for email (not synced to our Active Directory yet but looking into doing this)

and I'd like to start rolling out MFA but only for a few users initially

 

Reading the MS doc

https://docs.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication?view=o365-worldwide

I think I don't want to turn on Security defaults as that turns it on for everyone

 

"Conditional Access policies" sounds promising

and

"Per-user MFA (not recommended)" sounds like an easy first step

but can't see instructions from MS on how to do it ?!

 

Found this guide:

https://lazyadmin.nl/office-365/how-to-setup-mfa-in-office-365/

 

is this the "Per-user MFA (not recommended)" method ?

[mrstrong]

ok found this from MS

 

https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates

 

points you to https://portal.azure.com/

 

never used this before, usually just work in e.g. Admin Center e.g. Users > Active Users

Looks like just another GUI interface as when you click on MFA both take you to same page

[mrstrong]

well switched it on (MFA just for my user) installed MS authenticator app on phone and now get notifications on phone to approve

office 365 login, so far so good . Think you may need a paid license to use the "Conditional Access policies"

[robyholmes]

Yes you need a Azure P1 licence to use conditional access. We have MFA on for all our staff and use it to secure our remote desktop server as well. We allow users to bypass MFA when onsite by using conditional access to set a trusted IP.

[k-strider]

Yes you need a Azure P1 licence to use conditional access. We have MFA on for all our staff and use it to secure our remote desktop server as well. We allow users to bypass MFA when onsite by using conditional access to set a trusted IP.

 

can you buy Azure P1 license just for staff? if you are uk based can you give me a ball park as to how much this is per staff... we have an 2016/19 RDS infrastruture and would love to do this for that too...

[robyholmes]

can you buy Azure P1 license just for staff? if you are uk based can you give me a ball park as to how much this is per staff... we have an 2016/19 RDS infrastruture and would love to do this for that too...

 

We purchase P1 licence through our OVES volume licence, cost is around £5 per FTE. You get students licences for free. Although you might buy say 100 FTE P1 licences you'll get more in Office 365. Microsoft understand you might have staff who need the licence but don't count in your FTE. Governors are a good example.

[k-strider]

i think im gonna add that to our renewal come october... Thanks

[FragglePete]

We purchase P1 licence through our OVES volume licence, cost is around £5 per FTE. You get students licences for free. Although you might buy say 100 FTE P1 licences you'll get more in Office 365. Microsoft understand you might have staff who need the licence but don't count in your FTE. Governors are a good example.

 

Is that £5 per FTE per month ? Or £5 per FTE for the Year agreement? If that was per month for us it'll add some £10.5k to our agreement!!!

 

Pete

[free780]

Then you discover you really need P2 or A5. Then they send you a hacksaw for your arm and leg.

 

Though still cheaper in edu than business.

[MicrodigitUK]

Is that £5 per FTE per month ? Or £5 per FTE for the Year agreement? If that was per month for us it'll add some £10.5k to our agreement!!!

 

Pete

 

Per Year. We have P1 for most of our staff. Adds in some features that also help with managing Intune devices for staff. Also you get a tone of student ones for free. The free student ones have come in handy during lock down and handing out Intune laptops to students.

[FragglePete]

Per Year. We have P1 for most of our staff. Adds in some features that also help with managing Intune devices for staff. Also you get a tone of student ones for free. The free student ones have come in handy during lock down and handing out Intune laptops to students.

 

Well - that makes sense. Would be approx £900 on top of our current agreement which is a little bit more palatable. Agreement up for renewal in October so will take a close look at things then.

 

Pete

[mullet_man]

We've just purchased P1 Azure licenses based on our FTE count, where do these then cover students?

 

I only have the amount available that is our FTE count?

[highsky]

Yes, it's something like 1/15 or 20 students.

But the group control-enable needs a higher tier license.

You need to manually enable for each of your selected users.

Not sure if the CSV option allows you to import them back with the enabled MFA option.

Maybe it does.

[mullet_man]

Yes, it's something like 1/15 or 20 students.

But the group control-enable needs a higher tier license.

You need to manually enable for each of your selected users.

Not sure if the CSV option allows you to import them back with the enabled MFA option.

Maybe it does.

Thanks. Am guessing I haven't ordered correctly as I've ordered enough for our FTE count but not sure how we then get the additional for our students?

[mullet_man]

Yeah how to get Azure P1 licenses for students? I only have the ones I've purchased based on our FTE count. Obviously I've messed up somewhere!

[jmak]

I think you need to ask your reseller. They should be able to add the licenses you need. Pretty sure the deal is the same as the rest of OVS/EES where you pay for faculty fte and pupils are essentially unlimited.