Azure MFA - Conditional Access non P1 users

[Tefters]

Morning all,

 

Anyone running conditional access with non P1 licensed users.

 

I have A3 licenses (which has P1) on all my full time teaching and admin staff however I use the free A1 (which doesn't have P1) for kitchen staff, cleaners, exam invigilators etc.. as they access email twice a year if that.

 

Are they still covered by MFA CA even though they don't have the P1 license or does it just ignore their accounts for MFA?

 

Don't really want to spend £50 a year for an account that accesses email in a browser once a year for training links.

Edited June 21, 2024 by Tefters

[jezi55]

I have in writing from microsoft that as long as one of your global admin accounts have a P1 licence attached to it this is sufffient and enables conditional access for whitlising your schools public ip address. This means anyone logging into O365 offsite will require to authenticate. Although i did set this up 2 years ago and things might have changed but its still working our end.

[snagrat]

Morning all,

 

Anyone running conditional access with non P1 licensed users.

 

I have A3 licenses (which has P1) on all my full time teaching and admin staff however I use the free A1 (which doesn't have P1) for kitchen staff, cleaners, exam invigilators etc.. as they access email twice a year if that.

 

Are they still covered by MFA CA even though they don't have the P1 license or does it just ignore their accounts for MFA?

 

Don't really want to spend £50 a year for an account that accesses email in a browser once a year for training links.

 

What we do is assuming you have the Student entitlement from A3, then as we have so many licenses spare we allocate just the P1 element of the Student license to the A1 users.

[Tefters]

Thanks all.

 

What we do is assuming you have the Student entitlement from A3, then as we have so many licenses spare we allocate just the P1 element of the Student license to the A1 users.

Cheeky, I like it.

 

I'm not going to be nice and whitelist our public IP's because our web filter is off-site and all HTTP/S traffic goes through that which is shared with X amount of other schools and even if I did have an onsite one I still take the zero trust approach.