Enforcing MFA via Sign-in Risk Policy in Azure

To enforce multifactor authentication (MFA) specifically for users accessing resources from untrusted networks while minimizing administrative effort, Conditional Access policies are the standard mechanism in Microsoft Entra ID. The question specifies that security defaults are disabled, meaning default protections like MFA enforcement are not active, so a custom policy is required.

The key constraint is "minimize administrative effort." Microsoft Entra ID Protection provides automated risk detection without manual configuration of rules by the administrator. It analyzes sign-in behavior to classify risks as either "sign-in risk" or "user risk." Sign-in risk is associated with the specific event (e.g., logging in from an unfamiliar location or IP address), whereas user risk is associated with the identity itself (e.g., compromised credentials detected across the tenant).

Since the trigger is accessing resources from "untrusted networks" (a contextual factor of the login attempt), a sign-in risk policy is the appropriate choice. This policy type allows administrators to require MFA only when the sign-in risk is medium or high. Because the risk assessment is automated by Entra ID Protection, this minimizes administrative effort compared to manually maintaining conditional access rules based on static IP lists or complex conditions.

Option A (user risk policy) applies to the user's overall status rather than the specific sign-in context, which might result in excessive MFA prompts even for safe sessions if the user is flagged. Options B (access package) and C (identity governance policy) relate to entitlement management and lifecycle governance, not real-time authentication controls. Therefore, leveraging the automated sign-in risk detection via Conditional Access is the most efficient and accurate solution.