Question about location policy on Conditional access

Question

I am trying to understand the behaviour of the location rule in Conditional Access in Azure AD. We have a Conditional Access rule that will trigger MFA based on certain criteria. The location condition is set to Any location. We noticed that when user change from location to location (different IP address), that will trigger MFA even though the same user on the same device (except with different IP) has been verified with MFA (within the sign-in frequency period). I could not locate any MS documentation about this particular situation.

Thanks

Answer 1

Hello,

The behavior you are seeing with the location condition in your Conditional Access policy is expected. When the location condition is set to "Any location," it means that the policy will evaluate the user's location on every sign-in attempt, regardless of whether the user has previously been authenticated with MFA or not.

This means that if a user signs in from a new location (i.e., a different IP address) that they have not previously signed in from, the policy will evaluate the user's location and determine whether or not to require MFA based on the other conditions of the policy.

It's also worth noting that the sign-in frequency period only applies to subsequent sign-ins from the same location. If a user signs in from a new location, the policy will evaluate the location condition regardless of whether the user has recently authenticated with MFA from a different location.

You can find more information about location-based Conditional Access policies in the Microsoft documentation: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-conditions.

Answer 2

Do you have any risk based policies as well?

A change in sign-in IP would trigger a requirement for MFA if so.

https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies

Answer 3

Ok, it sounds like what you are seeing then is normal:

https://learn.microsoft.com/en-us/answers/questions/9633/will-ip-changes-trigger-reauthentication-for-micro