Alpine Ski House requires MFA for all users when accessing Microsoft 365 services from outside the corporate network. Users connecting from within the office should have a seamless experience without MFA prompts. What should the admin configure?
Select an answer to reveal the explanation.
Short Explanation
Conditional Access is like a smart doorman: same building, different entrance gets different treatment. You define your office IP ranges as a trusted Named Location, then require MFA only when users are not coming from that trusted location. Inside the office, they sail right through; outside, they prove themselves.
Full Explanation
The correct approach uses two Conditional Access components together: a Named Location and a Conditional Access policy. The admin creates a Named Location in Microsoft Entra ID representing the corporate IP ranges and marks it as Trusted. A Conditional Access policy is then created with assignments targeting All Users and All Cloud Apps; Conditions > Locations set to Any location but excluding the Trusted Named Location; and Grant control set to Require multifactor authentication. This means MFA is required only for sign-ins that do not originate from the Trusted corporate network — exactly the behavior required. Enabling Microsoft Entra Security Defaults, which automatically enforces MFA for all sign-ins, enforces MFA for all sign-ins regardless of network location. It does not support exceptions based on Named Locations, so users inside the office would still be challenged for MFA. Additionally, Security Defaults cannot coexist with custom Conditional Access policies — you must choose one or the other. Enabling per-user MFA for all users in the Microsoft 365 admin center and instructing users to register for MFA is a legacy approach that has been largely superseded by Conditional Access. Per-user MFA also does not natively support location-based exclusions without additional configuration. It would require users to register and be prompted for MFA even when on the corporate network, again failing the seamless-internal-experience requirement. Creating a Conditional Access policy that blocks all sign-ins originating from outside the corporate network's IP range goes far beyond the requirement. Blocking external access entirely would prevent remote work and any access outside the office. The requirement is to require MFA, not to block access — this approach imposes an overly restrictive control. Exam tip: The Conditional Access Named Location plus exclusion pattern is the standard enterprise approach to location-based MFA. Remember: Conditional Access policies evaluate INCLUDE minus EXCLUDE. If you include Any location and exclude Trusted Named Location, the policy applies to everything except trusted locations. Also know that Conditional Access requires Microsoft Entra ID P1 or P2 licensing (or Microsoft 365 Business Premium).