How to bypass Azure AD MFA by machine IP address using Trusted IPs?

Question

I need to bypass MFA when accessed from a particular machine. I have tried to add the machine IP address in trusted IPs list. But, it doesn't work. It throws the below error when using Connect-AzureAD. When i give default gateway IP, it works fine. 

Connect-AzureAD : One or more errors occurred.: AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must 

use multi-factor authentication to access '00000002-0000-0000-c000-000000000000'

How can bypass machine IP itself? Or explain how this works?

Answer 1

Hi O365developer,

We appreciate your update at your convenience.

Regards,

Jennifer

Answer 2

Hi O365developer,

Glad to hear from you again. To understand your situation better and provide further suggestions, could you please kindly send some screenshoots about the detailed configurations about the conditional access policy to us for analysis?

Thanks for your understanding and cooperation, I'm waiting forward to your updates.

Best regards,

Jennifer

Answer 3

I have tried these steps. But the problem is the machine's IPv4 address is not recognized. When I add gateway IP or public IP it works. Am i missing something?

Answer 4

Hi O365developer,

Have you tried the steps to see if it helps?

Regards,

Jennifer

Answer 5

Hi O365developer,

Thanks for post your questions in our forum.

Regarding your concerns, it is recommended to setup conditional access policy from the Azure Active Directory UI via following steps to see if it works: 

1. Sign in to  **Azure AD**portal with the admin account.
2. Click Azure Active Directory > Security > Conditional Access > click "+" to create a New policy.
3. Type the name of the policy.
4. Under Assignments > Users and groups, select the specific users who need to sign from a particular machine.
5. In the Cloud apps or actions tab, select all apps or specific APPs according to your demand.
6. In the Conditions tab, click Locations > switch to Yes under Configure, then under exclude, select Selected locations > MFA Trusted IPs.

7. Under Access controls, select Grant > Grant access > select the option "Require multiple-factor authentication", and click Save:

8. Try to sign in from the specific machine to test the result.

Here are some articles for your reference: 

• What is the location condition in Azure Active Directory Conditional Access?
• Tutorial: Secure user sign-in events with Azure Multi-Factor Authentication

Please feel free to contact us if you have any further problems and need further assistance.

Best regards,

Jennifer