Question

Contoso wants users to satisfy MFA when signing in to Microsoft 365, but the security team wants to reduce prompts when users are physically working from the corporate headquarters, which uses a fixed public IP range. They also require that any sign-in from outside that range always triggers MFA, and they must be able to prove during audits that the headquarters range is explicitly designated as trusted. What should you configure to meet these requirements with the least administrative effort?

Accepted Answer

Create a named location marked as trusted for the headquarters IP range, then create a Conditional Access policy requiring MFA for all users and exclude the trusted named location from the policy assignment.

Answer

Enable security defaults for the tenant and add the headquarters IP range to the MFA trusted IPs list under the legacy per-user MFA service settings.

Answer

Create a Conditional Access policy requiring MFA for all users, and configure a sign-in frequency session control set to 90 days for the headquarters IP range.

Answer

Create a named location for the headquarters IP range (not marked trusted) and build two policies: one blocking access from that location and one requiring MFA everywhere else.