Recently, Microsoft started to offer a free cloud-based Azure Active Directory Multi-Factor Authentication. The solution is based on Conditional Access requiring the MFA enrollment, based on grant conditions configured for all/or individual apps.Caption Learn how to take advantage of these services from Azure Active Directory! Once the configured time has passed user is removed by the automation from the group.Once user authenticates and redeems the code at the application user is placed to exemption group for the configured time.Admin creates exemption code, which runs automation to add user for exception group.In the end let automation remove the user from the group once the allotted time has passed.

I thought about it for a moment, and understood that its fairly simple to do by controlling group membership, where the groups is added as exception to the policy. There are multiple approaches to how to solve this problem (Azure Identity Governance being one for P2 utilizing customers) Our discussion continued, and the Customer pitched an interesting idea, could there be one-time code pre -delivered to the end user, to allow limited time enrollment? (Sites can sometimes be considered as trusted locations for MFA enrollment) Register Security Information supports placing requirements, such as trusted location, or trusted device, to allow MFA registration They are utilizing Azure AD Premium and using Conditional Access to block un trusted context for ‘MFA enrollment’ – This has presented interesting challenge to on boarding processes, due to the fact that employees/contractors (which have possibility of remote working) don’t go to sites that often these days. Few days ago a customer told me about challenges of doing secure MFA enrollment in larger enterprises.

Mfa conditional access