Forum Discussion
prashantguptag
Aug 22, 2016Brass Contributor
Enforce MFA to external users
Is there any news on enforcing MFA to O365 external users when they will access externally shared SPO sites? Right now the challenge is we cannot enforce MFA on external users and MFA can be enabled ...
Jesse Armstrong
Jul 12, 2017Copper Contributor
I am also curious about this.
The Azure AD pricing says for every Azure AD Premium account, 5 guests can be invited and can use Azure AD Premium license. I used a Conditional Access policy to force MFA for all users (including guests I am assuming, as I see their account in the Active Users page, but without any licenses). When the guest is invited, they log in and do not get MFA. I want to make sure they get MFA.
4Azure AD allows for B2B collaboration by enabling the use of a select set of Azure AD features to guest users who are invited into the Azure AD tenant. While some features are free, for any paid Azure AD features, guest users must be licensed as follows: with each Azure AD paid edition license that you own for an employee or a non-guest user in your tenant, you will also be able to invite up to 5 guest users to the tenant. The features you can extend to these guest users will depend on the type of Azure AD edition you purchase. There is no charge for inviting a guest user and assigning him/her to an application in Azure AD, for up to 10 apps per guest user. For paid Azure AD features that are extended to guest users, the inviting tenant will need the appropriate number of Basic or Premium P1 or Premium P2 licenses to cover guest users, in the 1 license: 5 users ratio as described above.
5Multi-Factor Authentication is available for Azure AD Free and Azure AD Basic, when you create a Multi-Factor Authentication Provider by the 'per user' or 'per authentication' billing/usage model. Pricing for MFA per-user and per-authentication options is described here.
- Jeff WestSep 05, 2017Copper Contributor
Did anyone ever close the loop on this?
Testing MFA at the moment, but came up with the use case of shared content with teams outside of my org. How am I to enforce MFA for those senarios?
Thanks!