Contoso requires MFA when users access Microsoft 365 from outside c…

Question

Contoso requires MFA when users access Microsoft 365 from outside corporate IP ranges, but not from trusted office IPs. How should this be implemented?

Accepted Answer

Conditional Access policy requiring MFA excluding (or not applying when) connections from trusted named locations for corporate IPs — Named locations = home base IPs. Conditional Access: leave home base → MFA.

Answer

Block all access from the internet permanently

Answer

Disable modern authentication

Answer

Assign Global Reader to all users

Contoso requires MFA when users access Microsoft 365 from outside corporate IP ranges, but not from trusted office IPs. How should this be implemented?

Short Explanation and Infographic

Full Explanation