2FA Conditional Access

Question

Hello,

I have plan to enable the 2FA gradually, starting from 10 users first.

We also have policy to disable 2FA for all users if they connected to corporate network.

So can we configure to enable the 2FA for this 10 users but the MFA only will activated when they not use corporate network?

Answer 1

Hello Handian Sudianto,

Thanks for your question.

Yes it can. To do this, I will recommend using named locations.

To do this, see: https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-assignment-network#how-are-these-locations-defined

Under your conditions you just need to specify that Under “Conditions to Set Exclude to All trusted locations. So, MFA will only be prompted when users are outside the trusted network. This policy can be created using this guide: https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-location

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Abiola