Google’s “BeyondCorp” whitepaper explores this in more detail. And even for those that can define a network boundary that traditionally would separate “inside” from “outside”, it’s somewhat of a dated concept.

It’s becoming more common for the concept of a corporate network to not exist at all for a company. App passwords, which are separate passwords for a user that bypass MFA, are also not practical in all cases as they become difficult to manage over time.įor some customers it’s not just a subset of their users, such as the sales staff, that access apps from “outside” the corporate network. Yes there are some apps where you can “remember” the device and avoid repeated prompts, but not all apps provide that. For example, a staff of roaming sales people will frequently be accessing their applications from outside the corporate network, which will cause them to be repeatedly prompted for MFA codes. This is useful for decreasing the annoyance factor of MFA for your end users, but doesn’t solve the problem for all types of organizations. The trusted IP feature is attractive because it allows you to define IP address ranges, such as those of your corporate network, from which you will “trust” the logins and not prompt for MFA codes.

Azure MFA, which provides more advanced functionality, including the option to configure trusted IPs.

MFA for Office 365, which provides basic MFA functionality for Office 365 applications only.

Microsoft provides some different options for securing Office 365 and Azure applications with multi-factor authentication (MFA).

Setup mfa office 365