Microsoft Entra - MFA Registration Campaign

[speckledegg]

Good afternoon,

 

I'm trying to set up MFA for our O365 users so staff are forced to register an authentication method before they can log on in at any location (in school or at home). To enforce this, I'm trying to use a combination of conditional access and a separate registration campaign (https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-registration-campaign).

 

The conditional access part is working as expected when testing and enforces MFA to users who are already registered when logging on and disables the prompts when logging on at school via our public IP address added to trusted locations.

 

However....the registration campaign will not trigger no matter what I try. From reading up on it, others have said we may need a Microsoft Entra ID P2 license as opposed to P1 and the campaign will silently fail otherwise. 

 

Ultimately, I want to set it up so staff are forced to set up MFA when logging in at school or working from home - at the moment, if they only log on at school, they will never be prompted to set up MFA on their account due to the trusted location added to conditional access which prevents them from being nagged for extra security whilst at school.

 

There are ways we can work around it, but it will just be less automated in future - so just seeing if anyone else has experienced similar 🤔

[ITGuyNW]

We have two policies setup to deal with this.

 

We only allow MFA registration while connected to school, otherwise what stops someone not the intended user from registering MFA? 

 

We block registration out of school using trusted IP and we allow access in school without prompting MFA (currently). This means without MFA, they will always be challenged off site. If they weren't blocked, they would be prompted to set up MFA. This forces staff to setup in school if they ever want to access anything outside of it.

 

 

[speckledegg]

Thanks for sharing your setup, that's really helpful - we may try and replicate something similar here in that case. I feel like I'm overthinking it all to be honest 😅