MFA with Conditional Access Deployment Feedback

[takers365]

Looking for feedback on implementation of MFA with conditional access in Azure. Do you find that you have push back from management with MFA or do you potentially start out with untrusted networks first and gradually expanding to internal? Have you found any drawbacks or disadvantages with this approach? Do some companies think untrusted networks is good enough and MFA is not needed on trusted networks? Would just like to understand how other admins/companies have implemented. Thanks

[#2]

@takers365 I´ve been asked by a number of customers to use this approach to ease the deployment. Identify public IP ranges and add these to trusted locations and require MFA for every auth not coming from these IP ranges.

One of the drawbacks with this approach is that IP-spoofing allows for further passwordspray, bruteforce etc.

However, this in mind I think it´s a good place to start your security maturity journey.