You have an Azure Active Directory (Azure AD) tenant. All administrators must enter a verification code to access the Azure portal. You need to ensure that the administrators can access the Azure…

An Azure AD Identity Protection user risk policy focuses on detecting and remediating compromised user accounts, not on enforcing access from specific network locations.

The multi-factor authentication service settings (specifically the 'trusted IPs' feature in the legacy MFA portal, or using Conditional Access with location conditions) allow you to specify IP ranges from which MFA is not required. By marking your on-premises network as a 'trusted IP' and requiring MFA for all other locations, you can effectively ensure administrators can access the portal only from your on-premises network while still enforcing a verification code.

Configuring the default for roles in Azure AD Privileged Identity Management (PIM) primarily manages just-in-time access and approval workflows for privileged roles, not network location restrictions for access.

An Azure AD Identity Protection sign-in risk policy assesses the risk of a sign-in attempt and can trigger MFA or block access, but it doesn't directly enforce access *only* from a specific on-premises network range.