Microsoft did create excellent Multi-Factor Authentication rollout materials that you can download, edit and send to the users. Send the instruction to the users by email, print them out, place them on their desks, or place them on the intranet.

Create an instruction on how to set up MFA.

Configure Conditional Access MFA with a couple of test users or with a Pilot group first before applying the MFA policy for all users.The IT support team will get phone calls and emails about the MFA enrollment or that applications are not functioning. Configure Azure AD Conditional Access MFAīefore you enable Azure AD Multi-Factor authenticationĭo not enable MFA for all users at once.Before you enable Azure AD Multi-Factor authentication.In this example I create a location for my office network which contains my external IP-address and mark it as Trusted Location. I assume you have already setup Multi-Factor Authentication and/ or Self Service Password Reset in Azure. My own network is registered as Named Location using my external IP-address.

In this blog post I show how to setup up a Conditional Access policy to restrict the registration of security information to only my own network.

We can now for example only allow registration of MFA information from our internal network, which we consider secure. With this new option we have the possibility to control the location from where an Office 365/ Azure AD user is allowed to register Multi-Factor Authentication (MFA) or Self Service Password Reset (SSPR) information.

About a week ago a new option in Azure Conditional Access showed up as User Action, Register Security Information.

Mfa conditional access