Conditional Access to require MFA to long onto domain joined computer

Question

Are you able to use conditional access to require MFA when logging into a domain user account on a domain joined computer?

Answer 1

There is a supported path for this but it requires ADFS:

https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-device-based-conditional-access-on-premises

Answer 2

For etc. Entra ID devices for the "Windows Sign in," I presume it's simply the user signing in on the Windows device itself right?

Certain applications, such as "Windows Sign In," do not have Conditional Access support. This particular application is utilized when a user logs onto an Entra ID Joined device, whether it's online or offline. Because the default Windows logon screen isn't built on a web-based user interface, conducting Conditional Access checks is not feasible.

I think it is that you refer to right? :)

Edit: Andy David - MVP answer for the ADFS is the only way as it is for now :)
We just write at the same time..

Answer 3

Yes, I am looking for away to require MFA when a user signs into a Windows device. So it sounds like to accomplish what I looking to do we would need to un-join the devices from the domain and then enroll them Entra ID?

Or can Azure AD Connect be used to accomplish what I am looking to do?