1

Afternoon all,

I am looking at a Conditional Access policy in Azure.

The policy I am looking at is Require multi-factor authentication.

Should I exclude any users from this? For example, service accounts? The one I have in mind is the following…

On-Premises Directory Synchronization Service Account

Many thanks

6 Spice ups
2

I guess I previously answered it

Go to Microsoft 365 admin center → Users → Active users → Select the user → Manage multifactor authentication → Select the user → Disable multi-factor authentication.

How is MFA enabled?

CA to exclude MFA https://support.voleer.com/hc/en-us/articles/360058029673-MFA-White-Listing

3

thank you, I was just wondering if there are other accounts like this (service accounts) that should MFA disabled. Or should MFA be enabled on all accounts, users and service?

4

I think an actual user account is being used to sync ad with Azure (Azure AD connect) rather than a service account.

Is it a simple case of re running the setup wizard for Azure AD connect to change the account used to sync?

5

Exclude all service account along with Azure sync account from MFA. Only users and admin accounts needs to be setup with MFA. You can create two Azure security group. Populate one group with all the service account and another group with your users who would require MFA. From your M365 portal, go to security, conditional access and configure your MFA there. Include necessary above group to require MFA and exclude necessary group to exclude them from MFA.

6

Yes, MFA should not be enabled for service accounts.