Global Secure Access M365 Traffic

Question

Global Secure Access M365 Traffic

Russell Ang 66

Hi,

Could you help to advise Endpoint is enrolled with Entra ID & GSA will automatically connected once have access to internet.

Possible to at least have MFA authenticate before can access to M365 Traffic?

Rukmini 3,841 Reputation points Microsoft External Staff Moderator

2025-06-13T09:22:35.4033333+00:00

Hello Russell Ang,

Did you get a chance to review the below answer? In case if you have any resolution, please do share that same with the community as it can be helpful to others.

Please let us know if any further queries so that we can try to help!

1 answer

Your answer

Rukmini 3,841 Reputation points Microsoft External Staff Moderator

2025-06-13T09:22:35.4033333+00:00

Hello Russell Ang,

Did you get a chance to review the below answer? In case if you have any resolution, please do share that same with the community as it can be helpful to others.

Please let us know if any further queries so that we can try to help!

Answer 1

Jinnie Nguyen 310 Independent Advisor

Hi Russell Ang,

Thank you for contacting Q&A Forum. I would like to provide my findings and proposed solution:

Yes, it is possible to require MFA before accessing Microsoft 365 services, even if the device is automatically connected to the internet and GSA

This can be achieved by configuring Conditional Access (CA) policies in Microsoft Entra ID.

Kindly let me know if this work for you and please let me know if you have any further questions.

If I have answered your question, please accept this as answer as a token of appreciation and don't forget to give a thumbs up for "Was it helpful"!

Best regards,

Russell Ang 66 Reputation points

2025-06-16T00:33:23.8666667+00:00

I already have conditional access configured but doesn't seem to be prompt for MFA.
Rukmini 3,841 Reputation points Microsoft External Staff Moderator

2025-06-16T06:06:45.9433333+00:00
Hello Russell Ang, If Conditional Access is configured but MFA is not prompting, it's likely because the device is already Entra ID joined and the user has a valid Primary Refresh Token (PRT) with MFA previously satisfied. In this case, Azure AD SSO skips MFA for seamless access.

To force MFA, you can:

Create a new test policy targeting the user and app with only “Require MFA” (no device compliance or location conditions).

Test the policy using InPrivate/Incognito mode or a fresh device to avoid token reuse.

Check Sign-in Logs to confirm whether MFA was triggered or silently satisfied.

Let me know if any further queries - feel free to reach out!
Russell Ang 66 Reputation points

2025-06-16T06:52:22.5133333+00:00

Hello @Rukmini

I've tested w/o enable network location, it will allow MFA authentication over untrusted location to access M365 resources.
Rukmini 3,841 Reputation points Microsoft External Staff Moderator

2025-06-16T07:46:21.24+00:00

@Russell Ang, Conditional Access policies will still enforce MFA from untrusted locations if they're set to apply to "All locations" or exclude only defined trusted ones.

When no named locations are set up, Azure AD considers all sign-ins as from untrusted sources, and MFA is enforced according to the configured policy.

Go to Conditions -> Locations and configure it.

Let me know if any further queries - feel free to reach out!
Rukmini 3,841 Reputation points Microsoft External Staff Moderator

2025-06-17T06:09:46.23+00:00

Hello @Russell Ang, Did you get a chance to review the above comment? In case if you have any resolution, please do share that same with the community as it can be helpful to others Please let us know if any further queries so that we can try to help!

Share via

Global Secure Access M365 Traffic

1 answer

Your answer