Going back to our company scenario, where MFA will be rolled out using Conditional Access (CA) policy based on TrustedIPs, I think I found a way to determine if a user setup MFA or not. I gave it a try and will consider it as an option for our MFA roll out. Informing users to access aka.ms/proofup is a good option to enforce MFA registration. Yes, communication is key for implementing additional security, such as MFA. If an employee has not yet setup MFA for their account, and an attacker gets their login credential and logs in to O365 from an untrusted network, the attacker will be prompted for the MFA setup and can then configure MFA for the employee (of course, using the attacker's preference for MFA). My concern is that not all users will immediately setup MFA while logged in to O365 from a trustedIP. How do you require users to setup (enforce) MFA for their accounts while logged into the trustedIP list of networks? This is preferred, instead of employees waiting until they are logging to O365 apps to setup MFA from an untrusted network. I would like to know how I can check which users actually setup MFA on their accounts, if we use MFA via CA policy.Ģ.

On other users that I have enabled MFA via the Azure MFA admin, or via powershell, and they actually setup MFA for their accounts, I can see that their MFA status changed from 'Enabled' to 'Enforced'. Is there a way to determine if users enforced MFA (actually setup MFA) for their accounts if MFA was applied by CA policy? When test users enforced MFA in their accounts, the Azure MFA admin still showed their accounts as 'Disabled' MFA state When I ran the powershell command to check their MFA status, their status did not show 'Enforced' either. I have questions on using MFA with CA policy:ġ. If users login to OWA, Outlook, or Skype from an untrusted IP address (I created lists of IP addresses in 'Named Locations' and have these lists in the Exclude section of requiring MFA), the user will be prompted to setup MFA and login using MFA authentication.The policy works. I am testing MFA with Conditional Access (CA)Policy.

Ms aka mfa