Bypass multi-factor authentication in Entra ID

In this topic, you will learn how to whitelist the IP addresses of Portnox™ Cloud services in Microsoft Entra ID so that you can bypass multi-factor authentication (MFA) when accessing Entra ID services.

Note:
Complete this task only if you have enabled multi-factor authentication (MFA) in Microsoft Entra ID for the policies used with Portnox Cloud. To check whether Entra ID MFA is affecting sign-ins and whether this bypass is required, navigate to: Monitoring > Sign-in logs. Select a tab for sign-in events, such as User sign-ins (interactive), use filters to locate the failed sign-in, then click on the entry link to open the Activity Details: Sign-ins pane on the right-hand side. Finally, click on the Conditional access tab and review the information shown there.

MFA based on Conditional Access

In this section, you will learn how to bypass MFA based on Microsoft Conditional Access.

  1. Open your Azure Portal dashboard.
  2. In the Search resources, services, and docs field, start typing conditional access, and then click on the Microsoft Entra Conditional Access entry listed below.

  3. In the left-hand side menu of the Conditional Access pane, click on the Named locations option.

  4. In the top menu, click on the + IP ranges location button.

  5. In the New location (IP ranges) pane, in the Name field, enter a name for the new range, and then click on the  +  button to add IP ranges. When done, click on the Create button below.

    In this example, we used the name Portnox Cloud but you can use any name you like.

    • If your instance uses the United States region for the Cloud RADIUS server, enter the following IP ranges:

      • 13.92.154.121/32 (used for network authentication)
      • 13.92.155.150/32 (used for AgentP enrollment)
      • 20.85.190.232/29 (a new IP range that will become the source of all Portnox Cloud traffic in the future)

    • If your instance uses the European region for the Cloud RADIUS server, enter the following IP ranges:

      • 13.95.164.190/32 (used for network authentication)
      • 104.40.220.180/32 (used for AgentP enrollment)
      • 20.67.6.144/29 (a new IP range that will become the source of all Portnox Cloud traffic in the future)

    • If your instance uses both regions, add all the IP ranges listed above.

  6. In the left-hand side menu of the Conditional Access pane, click on the Policies option.

  7. Find the policy that you want to edit in the list of existing policies and click on its name.

    Note:
    Select the policy that has multi-factor authentication enabled, where you need to bypass MFA to gain access to Portnox Cloud services.
  8. In the pane for the selected policy, click on Conditions > Locations > Configure > Yes > Exclude > Selected locations > Select, and in the Select pane, select the IP range you just created, click on the Select button, and then click on the Save button.

  9. Optional: If classic policies are configured, whitelist the IP addresses in classic policies, too.

Legacy MFA

In this section, you will learn how to bypass Microsoft’s legacy MFA (Microsoft Online Services).

  1. Open your Azure Portal dashboard.
  2. In the Azure Portal main menu, click on the Microsoft Entra ID option.

    You can access the main menu by clicking on the icon in the top left corner of the Azure Portal.

  3. In the left-hand side menu, click on the Manage > Users option.

  4. Optional: In the left-hand side menu of the Users pane, click on the All users option if it’s not selected (it is selected by default).

  5. In the top menu of the Users pane, click on the Per-user MFA option.

  6. Optional: Check if any users are configured with legacy MFA:
    1. In the Multi-Factor Auth status field, select the Enabled option and see if any users are listed below.

    2. In the Multi-Factor Auth status field, select the Enforced option and see if any users are listed below.

    If no users are configured with legacy MFA, you may skip the next step.

  7. Under the multi-factor authentication pane title, click on the service settings option.

  8. In the trusted ips section, enter the IP ranges in the CIDR notation (one per line) and then click on the Save button.

    • If your instance uses the United States region for the Cloud RADIUS server, enter the following IP ranges:

      • 13.92.154.121/32 (used for network authentication)
      • 13.92.155.150/32 (used for AgentP enrollment)
      • 20.85.190.232/29 (a new IP range that will become the source of all Portnox Cloud traffic in the future)

    • If your instance uses the European region for the Cloud RADIUS server, enter the following IP ranges:

      • 13.95.164.190/32 (used for network authentication)
      • 104.40.220.180/32 (used for AgentP enrollment)
      • 20.67.6.144/29 (a new IP range that will become the source of all Portnox Cloud traffic in the future)

    • If your instance uses both regions, add all the IP ranges listed above.