Page History

Because the Server/workstation is not joined to the domain the type of logon will be 'local logon'  Therefore we need to make sure the local logons will be protected even if the machine is moved into a separate location and no longer connected to the network(offline logon). 

First, create a domain-held policy Logon Policy to ensure MFA is required for all users on the StandAlone machine

...

Save the new Logon policy.

Now create the offline policies that will be needed once you remove the machine from the network.

Section
border true
Column Scroll down the policy and expand Offline Logon Check Enforce MFA on Local Computer Logon and Download Offline Tokens AutomaticallyOn the Administration Console go to Shortcuts>Check Policies Column width 60% Image Removed Panel borderColor #9EBEE5 bgColor #f0f0f0 borderWidth 1px Image Added

Save the new Computer Logon Client policy

Create an additional Computer Client Logon Policy which will exempt the Administrator account from MFA logon.

Save the new Computer Logon Client policy

...

Save the new Windows Offline policy

Create an additional Windows Offline Policy which will exempt the Administrator account from MFA logon.