Skip to content

Commit 0be3e74

Browse files
v-stsavellv-stsavell
authored
Merge pull request #8322 from MicrosoftGuyJFlo/SignInFrequencyAdd
[Intune] Conditional Access Sign In Frequency MFA Enrollment
2 parents 410d228 + 6242d89 commit 0be3e74

1 file changed

Lines changed: 43 additions & 35 deletions

File tree

‎memdocs/intune/enrollment/multi-factor-authentication.md‎

Lines changed: 43 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
---
22
# required metadata
33

4-
title: Require multi-factor authentication for Intune device enrollment
4+
title: Require multifactor authentication for Intune device enrollment
55
titleSuffix: Microsoft Intune
6-
description: How to require multi-factor authentication in Azure AD for Intune device enrollment.
6+
description: How to require multifactor authentication in Azure AD for Intune device enrollment.
77
keywords:
88
author: Lenewsad
99
ms.author: lanewsad
1010
manager: dougeby
11-
ms.date: 04/27/2021
11+
ms.date: 08/25/2022
1212
ms.topic: how-to
1313
ms.service: microsoft-intune
1414
ms.subservice: enrollment
@@ -28,12 +28,11 @@ search.appverid: MET150
2828
ms.custom: intune-azure
2929
ms.collection: M365-identity-device-management
3030
---
31-
32-
# Require multi-factor authentication for Intune device enrollments
31+
# Require multifactor authentication for Intune device enrollments
3332

3433
[!INCLUDE [azure_portal](../includes/azure_portal.md)]
3534

36-
Intune can use Azure Active Directory (AD) Conditional Access policies to require multi-factor authentication (MFA) for device enrollment to help you secure your corporate resources.
35+
Intune can use Azure Active Directory (Azure AD) Conditional Access policies to require multifactor authentication (MFA) for device enrollment to help you secure your corporate resources.
3736

3837
MFA works by requiring any two or more of the following verification methods:
3938

@@ -43,49 +42,58 @@ MFA works by requiring any two or more of the following verification methods:
4342

4443
MFA is supported for iOS/iPadOS, macOS, Android, and Windows 8.1 or later devices.
4544

46-
When you enable MFA, end users needs a second device and must supply two forms of credentials to enroll a device.
45+
When you enable MFA, end users need a second device, and must supply two forms of credentials to enroll a device.
4746

48-
## Configure Intune to require multi-factor authentication at device enrollment
47+
## Configure Intune to require multifactor authentication at device enrollment
4948

5049
To require MFA when a device is enrolled, follow these steps:
5150

52-
>[!Important]
53-
>You must have an Azure Active Directory Premium P1 or above assigned to your users to implement this policy.
54-
55-
>[!Important]
56-
>Don't configure **Device based access rules** for Microsoft Intune enrollment.
57-
58-
1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), choose **Devices** > **Conditional Access**. The Conditional Access node accessed from *Intune* is the same node as accessed from *Azure AD*.
59-
2. Choose **New policy**.
60-
3. In **New** policy, type a descriptive name for the policy.
61-
4. In the **Assignments** section, choose **Users and groups**.
62-
5. In **Users and groups**, choose **Select users or groups**, and check **Users and groups**. Then select the users and /or groups that will receive this policy, then choose **Done**.
63-
6. In the **Assignments** section, choose **Cloud apps**.
64-
7. On the **Include** tab of **Cloud apps**, choose **Select apps**, then choose **Select** > **Microsoft Intune Enrollment**, and then choose **Done**. By choosing Microsoft Intune Enrollment, conditional access MFA is applied only to the enrollment of the device (one-time MFA prompt).
65-
66-
For Apple Automated Device Enrollments using **Setup assistant with modern authentication**, you have two options:
67-
68-
| Cloud app | MFA prompt location | Automated Device Enrollment notes |
69-
| --- | --- | --- |
70-
| **Microsoft Intune** | Setup Assistant,<br>Company Portal app | With this option, MFA is required during enrollment and for each login to the Company Portal app/Company Portal website. Conditional access MFA is applied only to the login of the Company Portal on the device. |
71-
| **Microsoft Intune Enrollment** | Setup Assistant | With this option, MFA is applied only to the enrollment of the device (one-time MFA prompt). Conditional access MFA is applied only to the login of the Company Portal on the device. |
72-
73-
8. Choose **Done**.
74-
9. In the **Assignments** section, for **Conditions** you don't need to configure any settings for MFA.
75-
10. In the **Access controls** section, choose **Grant**.
76-
11. In **Grant**, choose **Grant access**, and then select **Require multi-factor authentication** and **Require device to be marked as compliant**. Then choose **Select**.
77-
12. In **New policy**, choose **Enable policy** > **On**, and then choose **Create**.
51+
> [!IMPORTANT]
52+
> You must have an Azure Active Directory Premium P1 or above assigned to your users to implement this policy.
53+
54+
> [!IMPORTANT]
55+
> Don't configure **Device based access rules** for Microsoft Intune enrollment.
56+
57+
1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
58+
1. Browse to **Devices** > **Conditional Access**. The Conditional Access node accessed from *Intune* is the same node as accessed from *Azure AD*.
59+
1. Choose **New policy**.
60+
1. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.
61+
1. Under **Assignments**, select **Users or workload identities**.
62+
1. Under **Include**, select **Select users or groups**, and check **Users and groups**. Then select the users and/or groups that will receive this policy
63+
1. Choose **Select**.
64+
1. Under **Cloud apps or actions** > **Include**.
65+
1. Choose **Select apps** > **Microsoft Intune Enrollment**.
66+
1. Choose **Select**.
67+
By choosing Microsoft Intune Enrollment, Conditional Access MFA is applied only to the enrollment of the device (one-time MFA prompt).
68+
69+
For Apple Automated Device Enrollments using **Setup assistant with modern authentication**, you have two options:
70+
71+
| Cloud app | MFA prompt location | Automated Device Enrollment notes |
72+
| --- | --- | --- |
73+
| **Microsoft Intune** | Setup Assistant,<br>Company Portal app | With this option, MFA is required during enrollment and for each login to the Company Portal app/Company Portal website. Conditional Access MFA is applied only to the login of the Company Portal on the device. |
74+
| **Microsoft Intune Enrollment** | Setup Assistant | With this option, MFA is applied only to the enrollment of the device (one-time MFA prompt). Conditional Access MFA is applied only to the login of the Company Portal on the device. |
75+
76+
1. Under **Conditions** you don't need to configure any settings for MFA.
77+
1. Under **Access controls** > **Grant**
78+
1. Select **Require multifactor authentication** and **Require device to be marked as compliant**.
79+
1. Ensure **Require all the selected controls** is selected under **For multiple controls**.
80+
1. Choose **Select**.
81+
1. Under **Session**.
82+
1. Select **Sign-in frequency**.
83+
1. Ensure **Every time** is selected.
84+
1. Select **Select**.
85+
1. In **New policy**, choose **Enable policy** > **On**, and then choose **Create**.
7886

7987
> [!NOTE]
8088
> A second device is required to complete the MFA challenge for corporate devices like the following:
89+
>
8190
> - Android Enterprise Fully Managed.
8291
> - Android Enterprise Corporate Owned Work Profile.
8392
> - iOS/iPadOS Automated Device Enrollment.
8493
> - macOS Automated Device Enrollment.
8594
>
8695
> The second device is required because the primary device can't receive calls or text messages during the provisioning process.
8796
88-
8997
## Next steps
9098

9199
When end users enroll their device, they now must authenticate with a second form of identification, like a PIN, a phone, or biometrics.

0 commit comments

Comments
 (0)