Forum Discussion

Ueli Zimmermann's avatar
Ueli Zimmermann
Brass Contributor
May 18, 2018

Azure Active Directory and ADFS support for Location based MFA ?

Any one knows if it is possible to kind of apply MFA only from like outside the defined trusted Networks and how to set this up if ADFS 3.0 is in play ?  i tried to use just AAD Conditional Access Policies but i figure with ADFS in play it might be different as with just PTA and Seamless SSO.

 

And additionally would this be possible that MFA just applies for like SharePoint Teamsite access but not to the OneDrive (My Site Collection Space of SharePoint), Yammer, Teams etc ?

 

The Customer does not use MFA yet and would like to start using it in collaborating with SharePoint Online with External Partners and Users but still not ready yet to globally use everywhere else to bother the users. Device based Conditional Access is not yet a Topic as the Environment is very Heterogeneous. 

 

regards

Ueli

Azure Active Directory (AAD)
Identity Management
  • VasilMichev's avatar
    VasilMichev
    MVP
    May 20, 2018

    You can use the claims rules engine to create rules that will apply MFA only on external logins. You cannot however limit this to only specific workflows, such as SPO. If you have such requirements, Azure AD Conditional Access is your best option.

    • Ueli Zimmermann's avatar
      Ueli Zimmermann
      Brass Contributor
      May 25, 2018

      Thank you, i figured that as well regarding claim rules.

      I have another question in the meantime though regarding the Conditional Access.

      Does this should work as well with Federated IDs or just with Cloud only an PTA and SSO Synced AD Accounts? 

       

      I justed created a Conditional Access Rules which should require me to use MFA if im not coming from a Trusted IP Range and if accessing SharePoint Online from Browser but no other target in Browser and no Modern Authentication App and it seems not to work for federated IDs.

       

      So for them i always have to use ADFS Claim Rules or is there something wrong with my Rule ?

       

      Best regards

      Ueli

      • VasilMichev's avatar
        VasilMichev
        MVP
        May 28, 2018

        Conditional access will work for federated scenarios, but it only applies to legacy auth. They just started previewing CA support for blocking legacy auth, so you can use the relevant controls as needed.

         

        It's still much easier to distinguish between external/internal access via AD FS claims rules, provided you use the recommended setup of AD FS servers + proxies.

  • Rishabh Srivastava's avatar
    Rishabh Srivastava
    Iron Contributor
    May 29, 2018

    Hello Ueli,

     

    As per your enterprise setup. I will try to explain what will happen under the hood when you have MFA configured in cloud for federated identities.

     

    Your user will go to https://portal.office.com --> and will be redirected to https://login.microsoftonline.com --> Since the domain is federated, the ADFS will complete the authentication and the provide a token to https://login.microsoftonline.com and now the conditional access policies will be triggered.

     

    Conditional access policy will be triggered irrespective of the authentication method you are using, as this is configured in azure. 

     

    2nd  scenario - where you have a MFA provider added in ADFS as well,

    - The MFA will be triggered by ADFS using MFA adapter

    - In this case azure mfa will not be triggered because the token provided to azure AD, will have a multipleauthn claim in the token.

     

    Now since this is a starting phase where you are testing, I would recommend to start either with exchange and not with sharepoint or onedrive.

    You can simple apply conditional access to either groups or set of users as well.

     

    ## Note - Conditional access is triggered when the primary authentication is completed, it is more over an authorization which is based on certain conditions, once validated the user will have access to the respective resource. 

     

    Regards,

    Rishabh

    • Ueli Zimmermann's avatar
      Ueli Zimmermann
      Brass Contributor
      May 30, 2018

      Thanks Rishabh,

       

      So basically what would you recommend me if i actually don't want depend to much on ADFS and ADFS Claim Rules but would rather like to use native Conditional Access with Azure MFA ? still have ADFS in place as we are not able to remove it right away (maybe in the future i would like to go PTA and Seamless SSO) but that can go a while.

       

      I still need the following covered:

       

      1. Only use MFA if it is outside of Corpnet

      2. Only use MFA for SharePoint Online SaaS and for nothing else

      3. Only use if connected via Browser (not for OneDrive fat client or so ever)

       

      BTW: This is basically because we want to rollout this package just for SharePoint Collab right now and not for anything else. Later we probably will go with Hybrid AD Join and Intune and for this step im than able to use Device Based Conditional Access which makes it even more easier.

       

      But again regarding the above 3 Requirements what would you suggest ? is this possible without ADFS Claims or do we need still the ADFS Claims ? and do i need than ADFS to connect to MFA Provider like AzureMFA or can i use the claim rules without using ADFS driven MFA and just use again Azure MFA without configuration inside ADFS ?

       

      Hope is stated clear for you otherwise ask me anytime.

       

      Cheers

      Ueli

      • Rishabh Srivastava's avatar
        Rishabh Srivastava
        Iron Contributor
        May 30, 2018

        Hello Ueli,

         

        As per your requirement :- 

         

        1. Only use MFA if it is outside of Corpnet

        - For this feature you have to add the IP address range of your enterprise in the MFA trusted IP's range option :-

         

         

        2. Only use MFA for SharePoint Online SaaS and for nothing else.

        - I am not sure if there is a way where in we have implemented a policy for sharepoint and it doesn't impact onedrive. This is something which you can check by creating a test policy.

        For saas applications added to your tenant, yes you can implement MFA and that too application specific. 

         

        3. Only use if connected via Browser (not for OneDrive fat client or so ever)

        While creating conditional access policy you get an option where in you can use the application type.

         

         

        Regards,

        Rishabh