Page History

Because the Server/workstation is not joined to the domain the type of logon will be 'local logon'  Therefore we need to make sure the local logons will be protected even if the machine is moved into a separate location and no longer connected to the network(offline logon). 

First, create a domain-held policy Logon Policy to ensure MFA is required for all users on the StandAlone machine

Section
border true
Column On the Administration Console go to Shortcuts>Check PoliciesExpand Authentication and select  MFA is required for all users from the drop down, Column width 60% Image Removed Panel borderColor #9EBEE5 bgColor #f0f0f0 borderWidth 1px Image Added

Save the new Logon policy.

It is also recommended to exempt at least one local account from MFA (usually the local administrator account)  just in case there is an issue that prevents the end user from being able to log on, the administrator will still have access without being challenged.

Section
border true
Column Expand General Authentication and check Enable MFA on local computer logonselect  MFA is not required for all users from the drop down, Column width 60% Image Removed Panel borderColor #9EBEE5 bgColor #f0f0f0 borderWidth 1px Image Added

Save the new Logon policy.

...

Save the new Windows Offline policyIt is also recommended to exempt at least one local account from MFA (usually the local administrator account)  just in case there is an issue that prevents the end user from being able to log on, the administrator will still have access without being challenged.Computer Logon Client policy

Save the new Logon Windows Offline policy.