Azure AD does not offer that functionality as part of Conditional Access (yet).Conditional Access demystified, part 1: IntroductionĬonditional Access demystified, part 2: What is Conditional Access?Ĭonditional Access demystified, part 3: How does Conditional Access work?Ĭonditional Access demystified, part 4: Designing a Conditional Access strategyĬonditional Access demystified, part 5: Implementing Conditional AccessĬonditional Access demystified, part 6: Troubleshooting Conditional AccessĬonditional Access demystified, part 7: Modifying Conditional Access to suit your special needsĬonditional Access demystified, part 8: Resources and further references

Require a specific multi-factor authentication method. It might feel counter-intuitive to have multi-factor authentication without prompts, but Microsoft feels the identity check for people using Azure AD-joined devices with TPM devices is sufficient to satisfy the MFA requirement. With the latest versions of Azure AD Connect and versions of Windows 10 beyond version 1607, the Hybrid Azure AD Join feature kicks in automatically when you include domain-joined devices in scope of Azure AD Connect. The AD FS Claims X-Ray functionality on Microsoft's AD FS Help page. For instance, when Captain Janeway uses Windows Hello to sign into a (Hybrid) Azure AD Joined device, that is equipped with a TPM chip, you'll see that her claim token would indeedĬarry the authenticationmethods claimtype. In some scenarios, multi-factor authentication does not require a prompt. The logs show that the MFA is satisfied by the claim in the token - the user doesn't actually perform it, they can log in regardless of location.

Sorry no - when user are loging in from outside they are NOT prompted, they just gain access.

Mfa conditional access