MicrosoftThank you. Although the post was mostly Powershell, it showed me the logic I was missing. Per the last screenshot, the word "except" is probably best read as "unless." Example, permit all in the Domain Users group and force MFA, unless they are also part of the No MFA group (since they would be part of both Domain Users and No MFA). The except is somewhat ambiguous in that without the 2nd rule to clarify, the first rule can read as if the No MFA group is permitted but excepted from MFA (instead of being excepted from permission altogether). Example, permit all in the Domain Users group, and force MFA excepting that they are also part of the No MFA group. This can get confusing if you must compound the logic as I needed to. Maybe it's just me...
