For: SharePoint / Microsoft 365 tenant administrators
Purpose: Let the DynoMapper crawl service account sign in without an MFA prompt — without disabling or weakening MFA anywhere else in the tenant.

---

Prerequisites

• Microsoft Entra ID P1 or P2 license. Conditional Access requires one of these. If your tenant is on Security Defaults only, skip to the note at the bottom.
• Global Administrator or Conditional Access Administrator role.
• A dedicated, read-only service account already created for the DynoMapper crawl — never a real employee’s account.

DynoMapper’s static IP addresses

• 35.86.4.170
• 52.37.219.87

---

Step 1 — Create a Named Location for DynoMapper’s IPs

1. Sign in to the Microsoft Entra admin center.
2. Go to Protection > Conditional Access > Named locations.
3. Select + IP ranges location (labeled “+ Add location” on some tenants).
4. Name it something identifiable — e.g. DynoMapper Crawler - Trusted.
5. Add both IPs in CIDR notation. A single address needs a /32 suffix:
   • 35.86.4.170/32
   • 52.37.219.87/32
6. Check Mark as trusted location.
7. Save.

---

Step 2 — Create a Conditional Access policy scoped to just the crawl account

Don’t add this exclusion to your existing “require MFA for everyone” policy — that would exempt the IPs for every user, not just the crawl account. Build a separate, narrowly-scoped policy instead:

1. Go to Protection > Conditional Access > Policies > + New policy.
2. Name it — e.g. DynoMapper Crawl Account - Trusted IP Exemption.
3. Under Assignments > Users, include only the DynoMapper service account. Not “All users.”
4. Under Target resources, scope to SharePoint Online (or whichever specific apps DynoMapper needs access to).
5. Under Conditions > Network (labeled Locations on some tenants), set Configure to Yes → Include Any network or location → Exclude the named location from Step 1.
6. Under Grant, select Require multi-factor authentication.
7. Set Enable policy to Report-only for now — don’t turn it on yet.

---

Step 3 — Check for conflicts with your existing MFA policy

If you already have a tenant-wide “require MFA for all users” policy, the crawl account may still be getting caught by it even after Step 2. Either:

• Exclude the crawl account from that policy’s user assignment, or
• Add the same named location as an exclusion there too.

Skipping this is the most common reason people find MFA is “still” being prompted from a location that’s supposedly trusted — the account passes the new policy but still hits the old one.

---

Step 4 — Test, then turn it on

1. Run a test crawl (or a manual sign-in) from DynoMapper.
2. In the Entra admin center: Identity > Monitoring & health > Sign-in logs → find the sign-in event → open the Conditional Access tab.
3. Confirm the new policy shows Applied, the location condition shows Matched, and no MFA challenge appears.
4. Once confirmed, switch the policy from Report-only to On.

---

If you’re on Security Defaults (no Conditional Access)

Conditional Access requires Entra ID P1 or P2. Without that license, this exemption path isn’t available. The only option is a dedicated service account with MFA turned off entirely — optionally restricted to DynoMapper’s IPs at the network/firewall level for an added layer of control, since that layer doesn’t require Conditional Access.