1

I have a school with 10 pcs for students to use but don’t want them to have to bother with MFA since it would require them to use their cellphones.

From the research I’ve done, it seems like I can setup a named location with a range of ips as a trusted location

Obviously all the YouTube and website tutorials I’ve found seem to be obsolete since Azure AD is now Entra ID

Regardless do you know if this is possible with the Microsoft Entra ID Free version or do I need to to upgrade to P1?

Thanks in advanced

bfff2e1f-9da4-44bb-9960-bc199b99cab8-entra_id.png

8 Spice ups
2

You will need Azure AD P1 minimum (its included in some licenses, depending what license level you use) and will need to setup Conditional access policies to do this,

But yes you can do it.

3 Spice ups
3

Molan is correct.

You can accomplish what you want with conditional access policies and named locations. However, you will need P1 have access to them.

2 Spice ups
4

Thanks guys, since they are students they are just using the free Office 365 A1 for students which obviously doesn’t come with P1

5

Hey guys, isn’t this all I need to do to set up conditional access to bypass MFA

68aea004-a78f-4388-9431-f3216e36b7d1-bypass_mfa.png
68aea004-a78f-4388-9431-f3216e36b7d1-bypass_mfa.png797×547 23.8 KB
6

Those are the partial steps yes. but they won’t apply to your users without the Azure AD P1 licenses assigned

I said partial steps as that shows you how to setup your trusted locations \ IPs (note its WAN IP not internal Subnets) but that doesn’t cover making the conditional access policy that will then exclude that trusted location

1 Spice up
7

Yep, I added a P1 license to my account for testing.

1 Spice up
8

I believe I found a better way to accomplish this. I tried this out and it worked perfectly

Bypassing MFA for on-premise logons

Usually you’ll want to skip MFA for users logging on when they are physically on site. This can be achieved through the MFA Service Settings page (which is not part of the Azure AD portal), enter your on-premise public IP address range(s) into the trusted IP box. You can also configure the verification modes available to users on this page, and configure whether users are allowed to “remember devices” to extend the lifetime of the login.

1 Spice up
9

I knew of this page, but I didn’t know it would allow you to exclude your on-premise. good find