MFA using Conditional Access VS Additional cloud-based MFA settings

[Alan Burchill]

We current have some IP Address Range exception and 14 days browser saving enabled in the "Additional cloud-based MDA Settings" will these setting work in combination with Conditional Access Policy? or will a CA Policy take precedence over these settings?

Alan

[#2]

@Alan Burchill 

Hi, the Conditional Access portal allows you to browse to the Configure MFA trusted IP's as shown below;

Selecting this takes you to the MFA service settings shown below.

So you should have no issue with this.  Conditional Access policies to enforce MFA will take effect even if the user has not been set to enabled for MFA, which is what CA is all about and how you want it to work.  

The verification options and remember MFA options that you set should work just fine in conjunction with CA though.

[#3]

If you want the IP range exclusion to take effect, you need to add "all trusted locations" condition to your CA policy, or at least the "MFA trusted IPs" location.

[#4]

@VasilMichev 

Absolutely yes.  @Alan Burchill - this can be set within the CA policy as shown below;

[#5]

Just to clarify, i know i can use IP address range and location in both... But if i have an IP address range configured... Are the settings additve? Or will it ignore the MFA server settings if a CA policy is applied?

[#6]

@Alan Burchill 

As far as I know, if you don't select locations options within the policy, it will use the settings defined in the standard MFA settings.  If you define locations within the policy, the standard settings become irrelevant.  That is my understanding.  Admittedly though, I have never tested this exact scenario.

[#7]

Yes these 2 settings are additive. In the sense that most restrictive setting wins. If both allow, then MFA not needed. Hope this makes sense.

Also, basic MFA setting applies at tenant level, so be careful not to lock yourself out while testing it.

[#8]

Thanks, got any reference that confirm that.... it would be helpful

[#9]

@Vikram V can you confirm that the rule for resolving conflicts is that the most restrictive policy wins? I was told that whatever was configured in the "Additional cloud-based MFA settings" blade had precedence over any conditional access rule.

Also, I'm trying to find the documentation for this scenario, but haven't been successful so far.