Forum Discussion
Enforce MFA to external users
Is there any news on enforcing MFA to O365 external users when they will access externally shared SPO sites? Right now the challenge is we cannot enforce MFA on external users and MFA can be enabled only for licensed users.
Azure B2B is in public preview but I am assuming that this capability will be available as part of Azure B2B GA as mentioned in current limitiation here. So question mark is if it will be enabled then will it also be applicable for normal external sharing scenario (with Azure B2B)?
- I was able to confirm that you can use Conditional Access Policies (features Azure AD Premium) to enforce MFA for external users on publicly shared SharePoint sites. External users must enroll in MFA immediately after signing in. An account is created in your Azure AD with the users email and some extra characters. For every 1 licensed user , 5 external users could use MFA. Some external users were confused whether to use their work federated account or their windows live account, and that caused confusion. It had to be clearly articulated that the account shared to had to be the one logging in. This caused some grief because the site was shared to a Microsoft live account, but the external user was trying to access the site from their network which had SSO and forced them to use their federated work account.
Jesse Armstrong wrote:
I was able to confirm that you can use Conditional Access Policies (features Azure AD Premium) to enforce MFA for external users on publicly shared SharePoint sites. External users must enroll in MFA immediately after signing in. An account is created in your Azure AD with the users email and some extra characters. For every 1 licensed user , 5 external users could use MFA. Some external users were confused whether to use their work federated account or their windows live account, and that caused confusion. It had to be clearly articulated that the account shared to had to be the one logging in. This caused some grief because the site was shared to a Microsoft live account, but the external user was trying to access the site from their network which had SSO and forced them to use their federated work account."For every 1 licensed user , 5 external users could use MFA. " is that free to the external users?
Thanks in advance!
- Yes, it is free to the external users. It does require you to have Azure AD premium licenses, so E3 or E5
Maybe this helps:
Look for the solution suggested by Sarat.
I am also curious about this.
The Azure AD pricing says for every Azure AD Premium account, 5 guests can be invited and can use Azure AD Premium license. I used a Conditional Access policy to force MFA for all users (including guests I am assuming, as I see their account in the Active Users page, but without any licenses). When the guest is invited, they log in and do not get MFA. I want to make sure they get MFA.
4Azure AD allows for B2B collaboration by enabling the use of a select set of Azure AD features to guest users who are invited into the Azure AD tenant. While some features are free, for any paid Azure AD features, guest users must be licensed as follows: with each Azure AD paid edition license that you own for an employee or a non-guest user in your tenant, you will also be able to invite up to 5 guest users to the tenant. The features you can extend to these guest users will depend on the type of Azure AD edition you purchase. There is no charge for inviting a guest user and assigning him/her to an application in Azure AD, for up to 10 apps per guest user. For paid Azure AD features that are extended to guest users, the inviting tenant will need the appropriate number of Basic or Premium P1 or Premium P2 licenses to cover guest users, in the 1 license: 5 users ratio as described above.
5Multi-Factor Authentication is available for Azure AD Free and Azure AD Basic, when you create a Multi-Factor Authentication Provider by the 'per user' or 'per authentication' billing/usage model. Pricing for MFA per-user and per-authentication options is described here.
Did anyone ever close the loop on this?
Testing MFA at the moment, but came up with the use case of shared content with teams outside of my org. How am I to enforce MFA for those senarios?
Thanks!
- Would like to know more about this also.
