Conditional Access - Block users outside school if they don't have MFA

[ITGuyNW]

Hi all

 

Don't know if I'm just overthinking this...

 

For those who have yet to setup MFA for whatever reason, I want to block their access outside of school.

 

At the moment, I have it set where if you are logging in in school, MFA is not required. If you try to log in outside of school, MFA is required. However, for those who have yet to setup MFA, its asking them to set it up for the first time. I want this blocked unless they are in school (trusted location). Anyone know what I mean and can help?

 

I'm trying to get my head around CA as its not like a firewall where I can just deny all etc.

 

Thanks

[NegativeKillDeath]

Try this Restricting registration to Azure AD MFA from trusted locations with Conditional Access policy – 4sysops

[TechMonkey]

Yes, this is what we have done. MFA can only be set up on site. Staff are warned about this and told to set it up before it is needed. Prevents bad actors managing to setup MFA for a compromised account.

[ITGuyNW]

Try this Restricting registration to Azure AD MFA from trusted locations with Conditional Access policy – 4sysops

 

Cheers, I found a similar one here

 

MFA Registration from Trusted Location - risual