We're rolling out MFA to about 800 users across multiple sites. We have a CA policy that requires MFA when users are offsite, but not when they're onsite. That part works fine.

The issue I'm running into is getting everyone registered before we enforce the policy. I want users to be forced to set up Authenticator while they're onsite, but not have to use MFA every time they sign in onsite.

I've tried the Authenticator registration campaign and the Identity Protection MFA registration policy, but neither seems to prompt users to register while onsite.

I know we could just enable the CA policy and let users register whenever they eventually sign in offsite, but I don't really like that approach. Some users may never sign in offsite, so they could go months without registering.…