You have a Microsoft 365 E5 subscription that uses Microsoft Teams. You need to enforce multi-factor authentication (MFA) for all users that access Microsoft Teams outside the corporate network…

A compliance policy typically focuses on device compliance or data governance, not directly on enforcing MFA for user sign-ins based on network location.

A Teams policy governs features and functionalities within Teams itself, but it does not directly control authentication requirements like MFA based on network location.

A sign-in risk policy is a specific type of Conditional Access policy that reacts to detected sign-in risks, but the question implies a blanket enforcement for all external access, which is better handled by a broader Conditional Access policy targeting location and app.

A Conditional Access policy in Azure Active Directory (now Microsoft Entra ID) allows administrators to enforce security requirements, such as multi-factor authentication, based on specific conditions like user location (outside the corporate network) or application being accessed (Microsoft Teams). By setting up a Conditional Access policy, you can ensure that all users attempting to access Teams from an external network are prompted for MFA.