Ask MFA if device is not compliant - not possible?

Question

I am testing different Conditional Access policies with MFA, so I have 3 different policy;

1. Office local apps -> device is compliant -> grant
2. Office local apps -> MFA-> grant
3. Office web apps -> MFA->grant

With these options, users with non-compliant device does receive MFA but are still not allowed in. But same user opening office.com from non-compliant device via WEB does get into Office web apps fine. I would like to archive the scenario, that if device is not compliant, MFA would pop-up for Office local apps. Not sure, is it even possible.

Answer 1

@Pavel yannara Mirochnitchenko Thanks for reaching out.

Under Office local apps policy, try this configuration and test :

Let us know if this meets your expectation.

---------------------------------------------------------------------------------------------------------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Answer 2

So I now have 3 policies;

1. Block All Office local apps.
2. Allow Office client apps without MFA if Device is compliant
3. Allow Office web & client apps with MFA.

I see this user activity in pic below, but he still gets "You cannot access this right now".

Fyi @VipulSparsh-MSFT

Answer 3

Just wondering here, does it make any since at all to target more than one Conditional Access policy to same user...?

Answer 4

I also have disabled Security Defaults because I don't want MFA being applied to everyone. MFA is enabled per user. Currently the situation is, that MFA is not promted when it should.

Answer 5

Okay, I think I got it... needed to redisign and re-thing this a little bit. Few tips I learned;

• AAD sign in logs has SOME delay, logs are shown later, maybe even 15min late.
  -. Failure means the CA has denied the attempt, so you need to understand the difference
  

-. MFA means also Fingerprint or PIN, so there not always would be Authentification app or sms code. I totally forgot about this.
-. In IP known locations, the external / public IP area matters, not the internal behind the NAT.