Conditional Access policy recommendation

Question

I am looking for recommendations of assigning policies. I want to enforce MFA for most users. If I assign the policy to "All Users" I capture all new users but it will apply to guest accounts and domain accounts for services etc that cannot have MFA. If I create a group and assign most users to it I run the risk that tech staff will 'skip' adding new users to the group leaving a gap in security.

What do you do? Do you create a group that MFA applies to or do you select "All Users" and have a group as an Exclusion with the group containing all the non-MFA accounts.

2nd question: If I do apply it to "All Users" and one of my users shares a folder with an external users (which creates a new guest account) will the new guest account be forced to enroll for MFA just like internal users?

Answer 1

Hi Steve,

Yes that is correct with the option 1 select all users for MFA and apply the ExcludeGroup for MFA containing breakglass account and service accounts, guest accounts.

Same principles will apply for 2nd Question and you can try the whatif tool on the portal to check the policies and how it will impact before making it live, also turn on Report only.

More detail steps over here and guidelines - concept-conditional-access-users-groups
Hope this helps.
JS

==
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.