Forum Discussion

Ravindra Mathura's avatar
Ravindra Mathura
Copper Contributor
Jan 09, 2020

Only prompt for O365 MFA when on external network (E1 users)

We have about 1000 E1 users that are using O365 MFA. We dont want them to receive MFA prompts when in office, only when on an external network. This can be done by the trusted IPs section in the O365...
Authentication
office 365
oliwer_sundgren's avatar
oliwer_sundgren
Iron Contributor
Jan 10, 2020

HelloRavindra Mathura ! 

Sadly no, the limit of 50 trusted IP ranges for the MFA part is not possible to work around. 

Conditional Access with named locations is the way to go. 

 

With Named locations you can use 

  • One named location with up to 1200 IP ranges.
  • A maximum of 90 named locations with one IP range assigned to each of them.

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition#named-locations

 

Since you have 300 IP ranges, you will need Conditional Access with Named Locations. 

 

Kind Regards
Oliwer Sjöberg

Resources