Will IP changes trigger reauthentication for Microsoft Conditional Access MFA?

Question

I am currently implementing Azure Conditional Access for a large group of users. Everything looks good, but we are getting complaints that people need to reauthenticate to often. We have configured the "Rememeber MFA" checkbox for 30 days. I would expect that if somebody logs in on device X with this checkbox checked, they would not have to provide a MFA token for the next 30 days; independent of their IP. But it seems that people get MFA challenges when switching a lot from IPs.

Is this correct behaviour? And what is the trigger for requesting a new MFA token? Also, suggestions to "fix" this behaviour?

Answer 1

@Ruben
Yes, change in network triggers MFA even if the user selected to remember it for X number of days . The only option to avoid triggering MFA is by configuring Trusted locations.

Answer 2

If you have configured to use a conditional access with the Location Condition with Any location then it will cause the policy to applied to all IP addresses. Also, changing a location would be detected within an hour of changing the network location for the applications using the modern authentication. Ideally, it is recommended to keep the MFA enabled on location change to block access from untrusted networks and by non legitimate users.
You can exclude specific locations from a policy by defining trusted locations or defining MFA trusted IPs. Please refer to the documentation -

• How to: Require MFA for access from untrusted networks with Conditional Access
• Trusted IPs