Your company has an office in London.

Setting

Correct selection

Authentication strength

Phishing-resistant MFA

Named location

IP ranges

The correct authentication strength is Phishing-resistant MFA . Microsoft Entra authentication strengths let administrators control which authentication methods satisfy a Conditional Access policy. The built-in phishing-resistant MFA strength is designed for methods such as FIDO2/passkeys , Windows Hello for Business , and certificate-based authentication , which matches the requirement exactly. Regular “Multifactor authentication” would allow broader MFA methods such as push notification, SMS, voice, or OTP, so it is too permissive. “Passwordless MFA” is also not exact because passwordless methods can include methods that are not necessarily the same phishing-resistant set required here.

The correct named location type is IP ranges . To mark a physical office such as London as trusted, you define the office’s public egress IP addresses as a Conditional Access named location and mark that IP range as trusted. Microsoft’s Conditional Access location guidance states that named locations can be created as countries/regions or IP ranges , and that when you select IP ranges, you can optionally Mark as trusted location .

Therefore, configure Policy1 with Phishing-resistant MFA and exclude a trusted named location created from the London office IP ranges .