Question

Contoso invites external guests from partner organizations to collaborate in SharePoint and Teams. Security requires that all guests satisfy MFA before accessing any cloud app. You create a Conditional Access policy assigned to 'All guest and external users' that requires multifactor authentication. After deployment, guests who have never signed in report they cannot register an MFA method and are completely blocked at sign-in. Contoso does not use cross-tenant access trust settings for these partners. What should you do so guests can complete MFA registration while still being protected?

Accepted Answer

Keep the MFA requirement but ensure the 'Register security information' user action is not blocked; guests register their own method at first sign-in when a method registration interrupt is allowed.

Answer

Exclude the 'Microsoft Intune Enrollment' and 'Microsoft Intune' cloud apps from the policy so guests can register.

Answer

Configure the policy to exclude the guest users, since MFA cannot be enforced on external identities without cross-tenant trust.

Answer

Change the grant control from 'Require multifactor authentication' to 'Require authentication strength' set to phishing-resistant MFA.