How to Add Trusted IP Addresses for MFA with Microsoft Graph or PowerShell
Question details
The user wants to configure and automate the addition of trusted public IP addresses for multifactor authentication bypassing using Microsoft Graph API or PowerShell.
- Product
- Microsoft 365 / Entra ID
- Device & OS
- not provided
- Scenario
- Configuring MFA security settings to bypass authentication prompts for users connecting from known, trusted corporate networks.
- Observed behavior
- The user needs the specific methods, endpoints, or administrative interfaces to successfully update the trusted IPs list for MFA.
Ensure you have the necessary Global Administrator or Conditional Access Administrator privileges in your Microsoft Entra ID tenant, and gather the exact public IP ranges in CIDR format before proceeding.
Configure Trusted IPs via Microsoft Entra Admin Center
The most straightforward method to add trusted IP ranges is using the graphical interface in the Microsoft 365 or Entra admin center.
While automation is powerful, configuring trusted IPs manually through the admin portal is recommended for initial setup or small network changes. This ensures you can visually verify the applied MFA service settings.
Log in to the Microsoft Entra admin center or Microsoft 365 admin center using an account with Global Administrator permissions.
Go to Protection, select Multifactor authentication, and click on 'Additional cloud-based MFA settings' to open the legacy MFA portal.
Locate the 'Trusted IPs' section. Check the box to skip multi-factor authentication for requests from federated users on my intranet, and enter your public corporate IP ranges using CIDR notation (e.g., 192.168.1.0/24) in the text box provided.
Click the Save button at the bottom of the page to apply the new trusted IP addresses to your tenant.
Automate Trusted IP Configuration via Microsoft Graph or PowerShell
For bulk updates or programmatic management, you can define named locations and trusted IPs using Microsoft Graph API or PowerShell modules.
Looking for a Lightweight Alternative to Microsoft Office?
While Microsoft 365 offers robust enterprise security features like MFA and Conditional Access, managing its complex admin portals can be overwhelming for individual users or small teams. If you simply need a powerful, easy-to-use office suite for daily document creation without the complex IT overhead, WPS Office is the perfect solution.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install the Suite: Run the installer and follow the quick on-screen instructions to set up WPS Office on your device.
- 3. Start Creating: Open WPS Office to instantly create, edit, and save documents in popular formats like .docx, .xlsx, and .pptx without needing an administrative setup.
Frequently Asked Questions
What format should I use when adding trusted IP addresses for MFA?
Trusted IP addresses must be entered using CIDR (Classless Inter-Domain Routing) notation. For example, to trust a specific IP like 104.40.156.1, you would enter 104.40.156.1/32. For an entire subnet, you might use a format like 192.168.1.0/24.
Can I add IPv6 addresses to the MFA trusted IP list?
Yes, Microsoft Entra ID supports adding both IPv4 and IPv6 public IP address ranges to your Conditional Access named locations and trusted IPs list.
Why are users still prompted for MFA even when connected to a trusted IP?
This usually happens if Conditional Access policies are configured to require MFA regardless of network location, which overrides the legacy MFA trusted IPs configuration. Review your active Conditional Access policies to ensure the trusted named location is properly excluded from the MFA requirement.
Where can I find support for Microsoft Graph API scripts failing to update MFA settings?
If your automation scripts are failing, verify your API permissions (such as Policy.ReadWrite.ConditionalAccess). For further troubleshooting, consult the official Microsoft Graph documentation or post your script logic in the Microsoft Graph and Entra ID developer forums.
