M365 2FA Authorization for a temp of a temp?

[Velvis]

My client has an employee who was hired through a temp agency. She is going on vacation for a week and the replacement will be coming from the temp agency as well.

The employee wants to know if her fill in for the week can have access to her email account without the need of downloading the authenticator app.

Which now that I think about it probably wouldnt be an easy thing to transfer for a week anyways.

Whats the best method to handle something like this?

 

[YeOldeStonecat]

Same computer? Same login username? Should be all set.
Or do they use web mail? Conditional Access can bypass MFA for "trusted locations" (WAN IP of the office).
Or ...if the temp person has a different login/365 account for herself, just give delegated access to it of the main persons mailbox.

 

[Sky-Knight]

Same computer and same login means the MFA has been met for the configured period anyway, so more than likely you won't have to do anything. By default it's 60 days until you need to MFA an endpoint again.

Otherwise yeah Conditional Access policy to skip MFA for stuff coming from the office's IP address sorts that out too.

I've got a few sites that don't want to fork over for premium, and I'm trialing Yubikeys to handle this. That device with the USB thing in it just doesn't need MFA because it's in the USB socket. There are many ways to do this...

But the RIGHT WAY is to give the temp of a temp their own account and delegate access to the appropriate one.

 

[nlinecomputers]

But the RIGHT WAY is to give the temp of a temp their own account and delegate access to the appropriate one.

This. For one thing it allows you to track the activity of the temp separately from your regular employee. If the temp misbehaves and steals data or something you have an audit trail that can’t be mistaken for the vacationing employee.

 

[Sky-Knight]

MFA enrollment has a two week grace period by default as well, so the super temp employee wouldn't need to enroll an authenticator, could just skip it for a week.