O365 - MFA and exclude certain users based on group membership

[bodminman]

Hi there,

 

I want to enable the security defaults on our tenant but I cannot fathom how to exclude groups of users. ie: primary section of the school. I would have thought this would have been a simple config option but it clearly isn't unless you make an additional purchase.

 

I have spoken to MS and they have said that I need a P2 licence, but the price they quoted was astronomical.

 

Can this be done any other way?

 

I'd also like to know what the pricing structure is for the P2 licence. Is it per user and is that based on FTE?

 

Thanks

[KK20]

You dont need P2, its P1 security -> conditional access. Just add the groups to the excluded section of your MFA policy. It is a good idea having P1 conditional access because you can also restrict MFA initial signup to trusted locations. Edited February 1, 2023 by KK20

[bodminman]

You dont need P2, its P1 security -> conditional access. Just add the groups to the excluded section of your MFA policy. It is a good idea having P1 conditional access because you can also restrict MFA initial signup to trusted locations.

 

Thanks for this.

 

Could you please message me and let me know roughly what you paid per licence?

 

Best wishes

[KK20]

a touch under £5 licensing for each "faculty/FTE staff/whatever microsoft call it these days" member - GN9-00010 for faculty and a nominal number of "zero cost" LE6-00001 students. This may be different for your licensing, we are hybrid still so im still on the "old" style desktop licensing.

 

Oh and here are the MS doucments for user exclusion of policy

https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policy-common

Edited February 2, 2023 by KK20