Azure AD conditional Access Policy Evaluation and Precedence

Copper Contributor


I'm working with a client currently using ~5000 Enterprise E3 & EM+S E3, and ADFS federation with AD Connect. I'm working with two AD security groups that are populated on-premises and get synchronized: All Company Users and Global Admins. 


They are self explanatory and Office 365 Global Admin accounts are in both groups. I am enforcing MFA for Admins all the time and Users when not on the trusted networks (we are on windows 7, but next year will go to windows 10 and I expect to manage this by device).


Should the policy below work?

Allow Access

Require MFA

Include Group: All Company Users ; Exclude Group: Global Admins

Selected Cloud Apps

Include: All Locations ; Exclude: Trusted locations

Using client Browser, Mobile and client Apps


I'm getting mixed results. Thanks for any help!


0 Replies