If your AD domain is visible in the public network and has a public DNS server, then follow the guide below to set up offsite logon

 Otherwise, follow the guide below to set up offsite logon

Please note: If you implement offsite Windows MFA logon with a public URL, then your users must make sure that they have completed an online MFA logon on their laptop computers before they take the laptop computers offsite. This is because the public URL of the logon agent has to be downloaded to the laptop computers, and download can only be carried out in an online MFA logon process.