MFA Trusted Locations not working for OneDrive client

[snagrat]

Have Conditional Access setup to ensure our school IP is whitelisted. For cloud apps it works fine, in school MFA is not required.

 

But for the OneDrive client MFA is still required. I was hoping to get this requirement removed as part of the conditional access.

 

The machines in question is domain joined, rather than AAD joined.

 

Has anyone got OneDrive working without MFA?

[KK20]

It works for us. We have a hybrid AD set up (with writeback and password sync). Currently no "pure azure joined" PCs but they are all hybrid join. Usual onedrive GPOs to autosign in. We too have a conditional for our IP4 addresses, we dont have any IP6 addresses. I didnt do anything out of the ordinary from what I remember.

[snagrat]

Thanks. I think it may because the machine are not Hybrid joined so will look into that.

[KK20]

I cant say, we had onedrive SSO before we had MFA and hybrid join enabled, I hybrid joined, removed ADFS, added MFA all around the same time as it was part of the final migration from "onsite" to "offsite". I dont remember SSO onedrive ever prompting though.

 

I just checked by MFA CA policy, it has the usergroups assigned, "all cloud apps", one condition being "any location, trusted locations excluded". Access controls "grant access require MFA" - all simple. I have a restrict MFA signup to my trusted location too (for obvious reasons). I then have a named location for the school IP egress ranges and that is marked as "trusted location".

 

Sounds daft, did you put a check mark next to "mark this as trusted location" for your school IP named location? That's the only thing I can think of. Do you have a CA policy for restrict MFA signup to trusted location? I assume that works.

 

hybrid join takes seconds to setup and I dont think there are any downsides. The only thing that will annoy you is the lack of AD azure knowledge of OU infrastructures so your dynamic groups are hard to set up if you have an OU mentality infrastructure!

Edited October 7, 2022 by KK20