MFA - Help

[leewakelam]

I have MFA applied to all staff accounts via conditional access policy in Entra. I have sent a forms out and for the majority it works but for some staff its not working and other staff says it works sometime and not the other. Is there any way i can check this or force MFA for all staff?

 

Any help would be appreciated

 

Thanks Lee 

[CHiLL]

We have our school IP addresses specified as locations in our MFA policy, targeted against our "All staff" group when NOT connecting through the specified locations. This is enough to trigger it every time when a user is not on-site.

 

Assuming yours is set up the same way, I'd recommend getting one of the users who says it doesn't work and getting them to hotspot using mobile data.

[foofighterjim]

Worth checking the Sign-in Frequency setting under the Session section, if not specified it will not prompt for MFA unless they have been inactive for 90 days on a device.

[leewakelam]

4 hours ago, CHiLL said:

We have our school IP addresses specified as locations in our MFA policy, targeted against our "All staff" group when NOT connecting through the specified locations. This is enough to trigger it every time when a user is not on-site.

 

Assuming yours is set up the same way, I'd recommend getting one of the users who says it doesn't work and getting them to hotspot using mobile data.

How do you setup the specified locations and what IP would you put in pleasde?

[Frodo_Baggins]

11 minutes ago, leewakelam said:

How do you setup the specified locations and what IP would you put in pleasde?

https://portal.azure.com/#view/Microsoft_AAD_IAM/SecurityMenuBlade/~/NamedLocations and then the public ip addresses for your sites

[Shaundor]

On 02/06/2025 at 15:39, leewakelam said:

How do you setup the specified locations and what IP would you put in pleasde?

 

Once you setup your named locations, using your Public IP, you can exclude that named location (Your public IP) directly in the conditional access policy to "stop" MFA from prompting, however this doesn't stop all cases, for example, accessing your security settings in 365 will always prompt for MFA regardless of the excluded named location.

 

The below Microsoft document details this: 

 

https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-assignment-network