MFA now enabled by default on new Office 365 Tenants

[free780]

[Edu-IT]

Am I right in thinking you need a paid licence to exclude MFA on certain IP addresses such as in school?

[aicrd]

Yes, I believe you need Azure AD Premium P2 for that (Or it may be P1?)

[robyholmes]

Yes, I believe you need Azure AD Premium P2 for that (Or it may be P1?)

P1 is all we needed.

[free780]

If you hybrid join all your clients and servers I think you can use AzureAD joined as a control as well as MFA which gets round the need for P1 issue. I can see that most orgs will need P2 at some point. You may need to push an extension to Chrome. Edited September 8, 2020 by free780

[Davit2005]

This made me think about the account used for Azure AD Connect. How does this effect the account used to Sync. Or is that account excluded?

 

Found following article but it is a bit vague.

 

https://techcommunity.microsoft.com/t5/azure-active-directory-identity/azure-ad-connect-sync-account-mfa-support/m-p/689153

Edited September 8, 2020 by Davit2005

[robyholmes]

This made me think about the account used for Azure AD Connect. How does this effect the account used to Sync. Or is that account excluded?

 

Found following article but it is a bit vague.

 

https://techcommunity.microsoft.com/t5/azure-active-directory-identity/azure-ad-connect-sync-account-mfa-support/m-p/689153

We have MFA enabled on the sync account and it only asks for MFA when making changes. Not when running a sync etc. The same as Outlook desktop or mobile apps don't re-ask unless you change security settings or device your using.