Azure MFA (through Conditional Access) with MFA Trusted IPs - Expected Behaviour?

[kidtrebor]

Hi there,

I've recently enabled MFA within my organisation, but excluded the MFA Trusted IP ranges, that excludes both the private IP subnets on the local network and the public IP of the org.  So far, so good.

After enrolling, users are then no longer prompted for MFA on that device - but if, for example, I open an in-private tab in Edge and try to log into office.com I am being prompted for MFA.

This is unexpected, because I'm logging in from a trusted IP - I wouldn't have expected to get a prompt for MFA on either an in-private login on a device I'm already logged into, or any other device onto which I'm logging in for the first time (from that trusted location).

Is this expected behaviour, or is there a problem with the way I've set up the MFA exclusion?

Thanks a lot.

Robert

[#2]

Have you checked if MFA is triggered by a CA policy? I normally look under sign-in logs. Do you have Identity protection policies configured by any chance? I recently blogged about it that may help here.https://rahuljindalmyit.blogspot.com/2022/03/using-conditional-access-to-enable.html

[#3]

How is the windows sign in done? WHfB? To my opinion this is expected behavior in a inprivate mode.

Can you check the Azure AD sign-in logs in the CA tab?

I would never exclude corporate offices/subnets from MFA. I would always require MFA for all sign-ins. Try to migrate to Windows Hello for Business to make sign-ins protected by MFA and bring SSO to the next level.