Exclude MFA for Office applicaions inside WVD

Kavindu Dayananda 76 Reputation points
2020-12-17T18:05:20.963+00:00

Hi,

We have a requirement to exclude MFA while accessing Office applications inside WVD while users are logging from our cooperate network .

I know that we can exclude WVD app/trusted locations from conditional access, and when we configure it like that ,it will not prompt MFA for WVD but will prompt for office applications inside. Our requirement is when users logging to WVD from their cooperate network , they should not get MFA prompt for any Office applications inside WVD session.

All the session hosts have only private static IPs. Public IP (Internet) is dynamic.

Please advise.

Regards,
Kavindu

Azure Virtual Desktop
Azure Virtual Desktop
A Microsoft desktop and app virtualization service that runs on Azure. Previously known as Windows Virtual Desktop.
1,362 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,465 questions
0 comments

5 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Marilee Turscak-MSFT 33,801 Reputation points Microsoft Employee
    2020-12-18T01:52:00.04+00:00

    You should be able to set up conditional access to exclude users from certain locations from the MFA policy while they are accessing certain applications using the steps in this article.

    The conditional access policies allow you to include or exclude users and allow you to select "mobile apps and desktop clients" based on locations. Is that what you are looking for?

    If it needs to be more granular than the options in that article, this may require a feature request in User Voice.

    0 comments
  2. Václav Kořánek SC 1 Reputation point
    2021-04-17T12:59:06.19+00:00

    Exclude place is for static IPs. But WVD has Public IP (Internet) dynamic.

    0 comments
  3. Simon Burbery 546 Reputation points
    2022-07-20T13:40:25.083+00:00

    You can add an outbound NAT gateway to the network your AVD hosts are in. That gives you a known outbound IP you can then exclude from your MFA policy.

    https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/configure-public-ip-nat-gateway

  4. Simon Burbery 546 Reputation points
    2022-07-21T13:26:13.783+00:00

    Maybe you could get an intune device license for the host? Then make sure it is compliant and you can exclude compliant devices from your MFA policy. I am not sure what cost that would be in your region, but it should be closer to 10 than 40.

    0 comments
  5. Simon Burbery 546 Reputation points
    2022-10-04T09:54:29.353+00:00

    Well @Václav Kořánek SC I hope you realized before I did... turns out assigning a public IP to a VM, the VM will always use that IP outbound as well !! I did not know this until reading about gateways again today...

    Even if you had 5 AVD hosts, assigning each one a basic public IP and excluding these from MFA is cheaper than the NAT gateway solution.

    My public IP costs less than NZD$4 / month... that is the solution for small deployments.

    0 comments