Which groups are created as part of the RM installation service and what are they used for?

We create the following groups:

• AAD MFA registration group - Members of this group have the multi-factor authentication (MFA) registration policy applied and are required to register for Azure AD MFA at logon.

Important: If you are planning to enable/have already enabled MFA in RM Unify, then please be aware that it would require a user to answer 2 x MFA challenges before gaining access to Microsoft 365 - an RM Unify MFA challenge before getting access to Azure AD and then an Azure AD MFA challenge before gaining access to Microsoft 365. The two MFA processes are entirely independent, so we recommend that you choose to use either RM Unify MFA or Azure AD MFA.

For more information on RM Unify MFA, please refer to RM Unify MFA.

• AAD user risk protection group - Members of this group have the user risk policy applied and will be forced to change their password, if Microsoft detects a high risk event has occurred. For more information on sign in risk and risk events, please refer to the following Microsoft technical articles:
  • Azure AD Identity Protection
  • Risk events

Important: Currently RM Unify does not support password write back, so this policy is not suitable for RM Unify federated users. Please include only users on a domain not federated to RM Unify and who are already able to change their password directly in Microsoft 365, e.g. a global admin user created directly in Microsoft 365.

• AAD sign in risk protection group - Members of this group have the sign in risk policy applied and are forced to authenticate using MFA, if something unusual is detected about their sign in, e.g. new location, device, app. For more information on sign in risk and risk events, please refer to the following Microsoft technical articles:
  • Azure AD Identity Protection
  • Risk events

• AAD location risk protection group - Members of this group have the location-based conditional access policy applied. If a user signs into Microsoft 365 from the trusted location, they will not be prompted for MFA but will be prompted for MFA when signing in from elsewhere. This configuration is optional and you may not have selected this opt in.
  
• AAD device compliance protection group - members of this group are prevented from signing into Microsoft 365 from devices that are not compliant with Intune policies. This configuration is optional and you may not have selected this opt in.