Question

Your organization uses Conditional Access to require MFA for all users. The finance team frequently complains about being prompted for MFA while working from the corporate headquarters, which uses a single fixed public IP address (203.0.113.10). Management wants to reduce MFA prompts for users physically located in the headquarters office while keeping MFA enforced everywhere else. What should you configure to achieve this with the least administrative effort?

Accepted Answer

Create a named location marked as trusted for the headquarters public IP range, then configure the Conditional Access policy to exclude that location from the MFA requirement.

Answer

Disable the Conditional Access policy for the finance team and instead enable per-user MFA for those users only.

Answer

Add the finance team users to the exclusion list of the Conditional Access policy so they are never prompted for MFA.

Answer

Configure a sign-in frequency of 90 days in the session controls of the Conditional Access policy.