I want a non-admin staff member to be able to publish a few documents and site pages.
She should be able to invite external users by herself by their private e-mail addresses through the site's built-in controls.
These external users should only be able to view and not make any modifications to the site, pages or documents.
I'm running into the issue that all our user accounts require MFA through the Microsoft Authenticator. That also unfortunately catches these external users. Changing this is not an option. A good chunk of our external users should require MFA.
Although these documents should require some form of authentication, something as strict as Microsoft Authenticator imposed on guests that we can't properly support is simply too much. The verification code that is periodically sent when logging in is enough.
The only solution I've been able to find is to make a security group, fill it with these external users and exclude it from my conditional access policies that require MFA. But that requires manual work from me. I cannot trust the staff member to do this correctly. Worst case she excludes someone from MFA that actually needs it.
Couple of things I've explored:
I've tried to invite the external users as full-fledged Microsoft 365 members. Then I could use this group to exclude from my conditional access MFA policies. Only problem is that the Edit permissions cannot be set to View for members. So that doesn't work. This also requires it to be a team site whereas a communication site seems more apt.
Authentication Contexts: It seems like this method can only be used to enforce stricter access, not override strict access into making it less strict.
Some kind of scheduled script that syncs these users to a security group that I can then exclude from MFA. This one shows some potential. Only issue is when the sync hasn't run yet by the time the user clicks on their email invite.
Any suggestions on how to solve this? Am I going about this all wrong?