Conditional Access: Require MFA Outside Corporate Network

Quick Answer

The answer is the Locations condition under Assignments > Conditions. This setting allows administrators to define trusted named locations, such as corporate IP ranges, and then require multi-factor authentication when access originates from any location that is not trusted. By configuring a policy that targets all users and Office 365 as the cloud app, and setting the Locations condition to exclude the corporate network, the policy enforces MFA for every external access attempt, directly meeting the requirement to require MFA outside the corporate network. On the Microsoft Cybersecurity Architect exam, this tests your understanding of how Conditional Access policies use location-based controls to enforce security boundaries, often appearing as a scenario where you must distinguish between user risk, device compliance, and location conditions. A common trap is confusing Locations with Sign-in risk or device state; remember that Locations is purely about geographic or IP-based trust. Memory tip: “Location locks the door—risk and device are for the guard inside.”