The AD FS Management UI is enough for making use of using MFA in most single “context” access scenarios. By this I mean, we are capable of enforce the requirement of MFA to fulfill regulations, that stipulate extra authentication is needed by use of one of either user/group, device or area. For example, if we check that a MFA policy needs to be used by area only, e. g. Extranet, we simply select the Extranet region checkbox.
All users connecting from outdoor of the corporate community must then use MFA. Conversely, if we want to implement MFA for a particular subset of users/groups, irrespective in their region Extranet/Intranet, by adding them via the users/groups option in the UI, this can be even be set. Finally, we also can specify that unregistered or registered instruments a la Workplace Join are looking to use MFA, via the gadgets checkboxes. The fact that these regulations may also be applied independently on a per depending party basis, often fulfill basic access policy needs. Help me to bear in mind more the conditional Access on ADFS with MFA.
I try to use what I learned out of your blog for my Scenario. I’m using ADFS 3. 0 on my Server 2012 R2 in combination With Azure Multi – Factor – Authentication Server. Everything is working fine. My End user has to use 2 Factor Authentication when not hooked up to Intranet. This was easy to configure as a result of here’s feasible With ADFS UI.
Because another way with my rule above Active Sync is not more operating. So I translate your Input to my case. I try to make a rule like if not Active Sync user and External then use MFA. So all adjustments I made before was reset. I think this was the explanation why it work again. “Update MsolFederatedDomain ” May this help to solve my Problem.
Do you notice any error on my command or do I have any wrong idea on my rule for the scenario I want to have?Normally I would expect it may work. Actual I can’t see my error. But I will keep you up to date on my issue. So long we are able to enjoy Christmas. Now again put an analogous command as I outlined on my first command.
Then I do a test before I execute “Update MsolFederatedDomain” against my Office 365 subscription. And now it’s worked as I’m expecting also I don’t execute the “Update MsolFederatedDomain”Well I think I also know what I do wrong on my first execution. The Rule was an analogous but on the powershell “Set AdfsRelyingPartyTrust” the 1st time when every little thing goes wrong I use the parameter Targetname “Microsoft Office 365 Identity Platform” instead of the Parameter “–TargetRelyingParty $ rp …I’m undecided if this was the Problem or something else but indeed the was the only difference before the 1st try to the second one.