Control Azure User SSPR/MFA from AD?

Question

I don't know if this is achievable but.... we want to see if we can automatically enrol users for Azure SSPR/MFA as soon as a mobile/cell number is added to their AD account. I can trigger workflow OK but the question is how to push out a change into AAD that adds the user to the SSPR/MFA policy?

Seems that MS have deliberately disabled this being based on AD group memberships and now is based on AAD policies - with the intention that this is managed directly through AAD.

So wondering if it's possible to do this from the AD side somehow?

Many thanks

Answer 1

Hello Bernie,

Currently, Microsoft recommends using conditional access to enforce MFA on a per-group basis. The following article should be helpful: https://docs.microsoft.com/en-us/azure/ ... ess-policy.