Exclude MFA for Non Users

[Ask_Ak]

Hello, what would be the best way to roll out MFA via a conditional access for users and exclude non user identities as teams rooms, conference rooms, shared devices out of it. I am looking for a way that is easier to maintain in future.

[#2]

Hello @Ask_Ak,

You can use different groups for those "non user" identities. 

For example, "Teams Rooms" for teams rooms, "Conference Rooms" for conference rooms, etc.

This will allow you to exclude the "non user" identities from the main MFA policy but in the future you will be able to create a separate CA policy for them (for example, to restrict access to those accounts from non company IP addresses.

[#3]

This could be one way but it requires maintenance as every time a new non-user identity is created it would have to be added to the group. I was wondering if there is a way to avoid that maintenance. Like use the same group but only assign MFA to user identities.

[#4 · Accepted solution]

@Ask_Ak 

1. You can create a Conditional Access policy based on "All guest and external users", "Directory roles" and "Users and groups". I don't think that you can filter out service accounts (non user identities). But

2. You can create a Dynamic User group. And add users to the group based on their names.

For example, you create a new Conference room account. Give it a name like "Conference-A102". So the rule should be like this: If the "username" contains "Conference" move it to the "Conference Room" group. Same with other types of non user identities.

[#5]

@Ask_Ak 
Maybe bit off topic, we had the experience of room-accounts becoming disabled via an automatic process in the background in Azure AD. This was because after creating the Room account the password did not match the password policy when they were created.

Maybe this remark will help someone else.