Skipping Azure MFA for intranet must need ADFS?

Hello @Dick Ye ,

Thanks for reaching out.

Yes, this should need federation (ADFS) in-place, because ADFS issues the insidecorporatenetwork claim to Azure MDA for users who access from intranet.

Assuming that AD FS is configured correctly, let’s discuss below scenarios:

The domain is federated using AD FS, there is a conditional access to require MFA from any location except MFA trusted IP’s as below, also “Skip MFA for Requests From Federated users on my intranet” option Enabled.

In this Scenario, MFA will be skipped for internal users and will triggered for external users, because AD FS will send a claim “insidecorporatenetwork” to Azure to determine if the request is internal or external, for example if the request came from the internal network we can see that AD FS issued the insidecorporatenetwork claim with value “True” which means that the request came from internal which will not trigger MFA based on the option we selected before to Skip MFA for internal requests.

Its worth to refer this article and hope this helps.

------
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.