Issue with Azure VM Conditional Access for Office 365 and Dynamic Public IP Detection

Hi AB21805,

It sounds like you're experiencing difficulties with configuring Conditional Access policies to allow MFA bypass for an Azure VM due to dynamic public IP detection. Here’s a structured approach to troubleshoot and resolve this issue.

Step-by-Step Guide to Configure Conditional Access for Office 365

1. Verify Network Configuration

Ensure that your VM is configured correctly with respect to its networking setup.

• No Public IP: Verify that the VM indeed has no public IP associated. Check both the NIC and the Azure VM overview.
• NAT Gateway/Firewall: Ensure that no NAT Gateway or firewall settings are causing the VM to be seen with a public IP.

2. Use Azure Bastion or Private Endpoint

Consider using Azure Bastion or a private endpoint to securely access your VM without needing a public IP.

3. Static Public IP (If Necessary)

If you must use a public IP, consider assigning a static public IP to the VM to ensure consistency for Conditional Access rules.

4. Configure Conditional Access Policy

Step-by-Step Configuration:

1. Sign in to the Azure portal:

   • Go to Azure Active Directory > Security > Conditional Access.

2. Create a new Conditional Access policy:

   • Click New policy.
   • Name your policy (e.g., "Office 365 MFA Bypass for Azure VM").

3. Assignments:

   • Users and groups: Select the users or groups that need the policy applied.
   • Cloud apps or actions: Select Office 365 or specific Office 365 services (e.g., Exchange Online, SharePoint Online).

4. Conditions:

   • Locations:
     • Under Include, select All locations.
     • Under Exclude, choose Selected locations, then select the location of your Azure VM.
     • If your VM uses a dynamic public IP, you can use the IP address range of your Azure region or the specific static IP if assigned.

5. Access controls:

   • Under Grant, select Grant access, then enable Require multi-factor authentication.
   • Use Session controls if necessary.

6. Enable Policy:

   • Set Enable policy to On.

7. Save the policy.

5. Check IP Address Visibility

To determine the public IP address seen by Office 365 from the VM:

1. Log into the VM.
2. Open a web browser and search for "what is my IP" to check the IP address being used.

6. Dynamic IP Handling

If a dynamic IP is unavoidable, consider:

• Using a VPN: Configure a VPN for the VM to ensure a consistent IP address.
• Azure AD Named Locations: Define a Named Location in Azure AD with the IP address range of your Azure environment.

Defining Named Locations:

1. Navigate to Azure Active Directory > Security > Conditional Access > Named locations.

2. Add a new location:

   • Name the location (e.g., "Azure VM IP Range").
   • Add the IP address range or specific IP addresses.

3. Use this Named Location in your Conditional Access policy as described above.

Conclusion

By following these steps, you should be able to configure Conditional Access policies that effectively bypass MFA requirements for Office 365 on your specific Azure VM. Ensure the VM network setup is correctly configured and consider using static IPs or VPNs for consistency.