The user will now be removed from the exception to the CA policy. a code via Text Message, call, or just a push notification. Whenever a condition fulfills, that user will be granted MFA and will be asked to enter the second way of authentication i.e. Another way to enable MFA is with some conditions. If you want to reverse the action or remove a user from the exception -> under the 'Select excluded users', you will see all the users and groups that are excluded from the CA PolicyĬlick on the three dots next to the user and click on Remove Office 365 Admin Center Active Users page Conditional Access. Save the changes and the user/group selected is now excluded from the CA policy.

In the Exclude tab, click on Select excluded usersįirstly, search the name of the users or groups that you want to exclude from the Conditional Access policy Employee workforces today are dynamic and are working on several devices from several different locations. No longer do administrators have to simply worry about the four walls of their building. For the purpose of this tutorial, we will use the conditional access policy 'Require MFA for access from untrusted networks' Conditional Access, when paired with Azure Active Directory, is a tool used to provide next-generation identity services in the cloud age. Select the CA policy you want to exclude a user from. On the left menu, select the Security Page Head over to and log in with your Admin account.Also, Check if the MFA is not applied to All Users including excluded ones.These steps show how to exclude users from a Conditional Access policy. Go to > Azure Portal > Azure AD > Security > Identity Protection > MFA registration policy > Assignments > Users > If all users are included > Exclude the specific user > Enforce Policy > On > SaveĪlso, Validate if there's any other Azure Policy added to the excluded users that is forcing MFA. If MFA is not needed you need to exclude the User from this Policy. Make sure you have the below settings configured for MFA Registration Policy in Azure AD identity Protection.

Tried logging in with usersid who was excluded from the Policy and did not receive any MFA prompt like below:. Tried logging in with spuser who was included in the Policy and got an MFA prompt like below:- If you are entitled to Conditional Access (Without AAD P2), you could Enforce MFA with CA Policies and then have an Exclusion AD/AAD Group that you put the.

Along with the conditional access policy, I also configured the MFA authentication registration policy.Ĭonditional Access Policy MFA Include User:-Ĭreated Conditional Access Policy successfully like below:. I tried to create one Conditional Access Policy in the Azure AD for enabling MFA for specific users and excluding others.

Conditional access mfa