I manage IT for a multisite small-to-medium business with about 180 users. We use Google Workspace as our primary identity system, have no Active Directory, and all user accounts are local to each workstation. We also have Microsoft 365 Apps for Business licenses, but each license is attached to an otherwise unused Microsoft account such as [email protected]. These accounts are used only to validate the Office subscription and have no other business purpose.
Microsoft is expected to require MFA for these accounts soon. Many of our users are not especially technical, so enrolling everyone would create a large support burden without much perceived benefit: if one of these accounts were compromised, we could simply revoke the session or disable the account.
Is there a supported way to disable or bypass MFA for these Office licensing accounts? If not, would Google federation, single sign-on, or switching to perpetual or volume-licensed Office be a better approach?
4 Answers
Federation is probably the cleanest fit for your environment. Users would sign in with their Google accounts and Google would handle the second factor, avoiding a second set of credentials and enrollment steps. Test this with a small group first, especially desktop Office activation, cached credentials, account recovery, and what happens when a user changes devices.
Even if Microsoft’s initial requirement only applies to certain administrators or higher-risk accounts, treating MFA as unnecessary is risky. The accounts can still be used to access Office-connected services, activate software, or become a foothold for other attacks. At minimum, protect administrator accounts immediately and consider using federation so users get one familiar sign-in experience.
Before building a federation setup, compare the total effort with buying perpetual Office licenses or an appropriate volume-licensing option. A standalone version may remove the recurring identity and subscription-validation requirement, although you would need to confirm the exact licensing terms, upgrade rights, and whether your users need features available only in Microsoft 365 Apps.
The usual route is to federate your Microsoft identity tenant with Google. Users authenticate through Google, so they can use the MFA and sign-in policies they already have there. Microsoft can be configured to trust MFA completed by the federated identity provider instead of prompting for a separate Microsoft MFA challenge. The setup is more involved than standard federation in the opposite direction, and you should verify that Office activation works correctly with the chosen web-based sign-in flow.
The support burden is real, but federation usually reduces it because users keep using the MFA method they already know in Google rather than enrolling in another authenticator separately.