1

Hello,

We are in the middle of an Office 365 migration and looking to implement 2 factor on our E3 and E1 accounts.

I see there is a builtin function and its working on the few accounts we tested.

Is there a way with my E3 / E1 license to white list our Office public IP so that users do not need to use 2 factor when in the office?

So far it seems I can only do this by adding Azure MFA to each mailbox at additional costs.

Does anyone have experience using 365 2 factor and how do you handle daily use of 365 when users are in the office?

I anticipate getting push back if they need to verify via phone every-time they use 365 even if they are in the office logged into the domain.

We have a number of users that will only use web mail, thus the E1 accounts so any suggestions on how to use a 2 factor option without annoying the masses would be welcomed.

Thank you,

Adam

6 Spice ups
2

  1. two-factor authentication is annoying. This is by design. :wink:

  2. I do not know of any method to require MFA, except when at the office (also that can be spoofed, so it may not be an option at all. And if you factor in VPNs, the setup and configuration of such a scenario suddenly gets overly complicated.)

  3. MFA tends to require the use of an application password, so if you put it on regular Outlook accounts, it gets even more annoying. We had MFA turned on for my boss at one point, about a year ago, and it locked out his domain account, because O365 MFA decided to use his application pwd for his domain password. Didn’t take long to decide to hold off on deploying MFA to the end users.

  4. We get our MFA codes via text message. Does everyone have a company issued cell phone, or are you planning to send text messages to their personal devices?

Sorry, not to rain on the parade. I simply do not think MFA currently equals annoying.

If someone else has better ideas, I’d love to hear them.

3

When you use MFA you get an APP token that can be used as the in office password.

In O365 admin

Go to Users > Active users.

Choose More > Setup Azure multi-factor auth.

On the multi-factor authentication page, choose service settings.

Under app passwords, choose Allow users to create app passwords to sign into non-browser apps.

People can then use client Office apps after they create a new password.

Choose Save, then choose Close.