Office 365 MFA disable external access if not enforced

Question

So there are three MFA settings. Disabled, Enabled and enforced. Enabled is set and then the user can authenticate using only name and password at which point they have to enroll in the MFA process.

We have 100% requirement that all users have MFA enabled. Unfortunately some of them don't complete this process because they never check email outside the company.

Is there a setting that I can disable authentication from ALL users that have disabled, or enabled, set for MFA UNLESS the request comes from an IP that is on the trusted IP list. This will ensure that no authentication requests are accepted from OUTSIDE the corporate network that are for users that do not have MFA enforced meaning they have completed the enrollment process.

Thanks John

Answer 1

Set it to Enforced if you want them to go over the registration policy. Or better yet, toggle Security defaults on.

Answer 2

Unfortunately, that does not answer my question at all.

Enabled or enforced still allows authentication until the registration process has been completed. Therefore the users that are using outlook inside the trusted IP network are never prompted or have to complete the registration process. This means that a would be hacker can still authenticate from outside the network without having to enter MFA because MFA process has not been completed. In fact - if he gained access - he could complete the MFA process using his own cell or whatever.

toggle Security defaults on? that sounds intriguing but I have no idea what security defaults you are referring to.

I would think this would be a common sense flag that could be set

Disable access for any user that does not have MFA registration complete unless coming from a trusted IP. Thats what I would like to do - how does one accomplish that?

Thanks
John

Answer 3

Will do - I have a ticket open with our Azure escalation support partner to see if they can help me figure out why its not applying.

Thanks
John

Answer 4

https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates

"The user is enrolled per-user in Azure AD Multi-Factor Authentication. If the user hasn't yet registered authentication methods, they receive a prompt to register the next time they sign in using modern authentication (such as via a web browser). Users who complete registration while in the Enabled state are automatically moved to the Enforced state."

Answer 5

What about a conditional access policy to grant access only if MFA is enforced.
As per my understanding, you should be able to create a policy with a check mark for "Require multi-factor authentication"

You can also add conditions of trusted locations at the same time.
With that I have witnessed, this makes sure any user will be granted access only when MFA is enforced. (Yes I know enforced is not the same as enabled :) )

Please let me know if this helps or not, I am testing a few things and if I come across something else, will surely update here.