MFA and MDM

Question

Looking for advice.&nbsp;I want to enable MFA for all staff with the condition that they are only prompted for the second authenticator when they are outside of the office. For this to happen am i right in believing we would need to be on version 2016 of ADFS at the very least? We also want them to be able to choose between the APP and SMS \ Voice. (I`ve already posted earlier today about the issue of multiple SMS being received when firing up my laptop, Skype, Sharepoint, Teams etc.&nbsp;I would also like the couple this with MDM, in particular for on-premise AD accounts with non-domain joined machines. These are external 3rd contractors carrying out work on the behalf of my company. I want to be able to manage \ limit what those machines can access in Azure, but I am struggling to find information on anything that is not domain joined.&nbsp;&nbsp;

joachim løe · Answer

Hi,&nbsp;You can use https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview to enable the second factor when outside "https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/untrusted-networks".If you are using https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfaserver-adfs-2012, the trusted location's should work as expected and only apply the factor when connecting from "Unknown Networks".In regards to restricting Non-Domain Joined devices to resources in Azure, you can use the Conditional Access Policy to only allow "Hybrid Azure Joined device" to access the Services. When the 3rd part contractor tries to access the resource with his/hers Non Domain Joined device, it will be restricted.https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-federated-domains&nbsp;The Multiple SMS issue, change your MFA preference to use Authenticator Apphttp://aka.ms/mfasetup

Forum Discussion

MFA and MDM

1 Reply

https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-federated-domains