Forum Discussion
Azure Active Directory and ADFS support for Location based MFA ?
Hello Ueli,
As per your enterprise setup. I will try to explain what will happen under the hood when you have MFA configured in cloud for federated identities.
Your user will go to https://portal.office.com --> and will be redirected to https://login.microsoftonline.com --> Since the domain is federated, the ADFS will complete the authentication and the provide a token to https://login.microsoftonline.com and now the conditional access policies will be triggered.
Conditional access policy will be triggered irrespective of the authentication method you are using, as this is configured in azure.
2nd scenario - where you have a MFA provider added in ADFS as well,
- The MFA will be triggered by ADFS using MFA adapter
- In this case azure mfa will not be triggered because the token provided to azure AD, will have a multipleauthn claim in the token.
Now since this is a starting phase where you are testing, I would recommend to start either with exchange and not with sharepoint or onedrive.
You can simple apply conditional access to either groups or set of users as well.
## Note - Conditional access is triggered when the primary authentication is completed, it is more over an authorization which is based on certain conditions, once validated the user will have access to the respective resource.
Regards,
Rishabh
Thanks Rishabh,
So basically what would you recommend me if i actually don't want depend to much on ADFS and ADFS Claim Rules but would rather like to use native Conditional Access with Azure MFA ? still have ADFS in place as we are not able to remove it right away (maybe in the future i would like to go PTA and Seamless SSO) but that can go a while.
I still need the following covered:
1. Only use MFA if it is outside of Corpnet
2. Only use MFA for SharePoint Online SaaS and for nothing else
3. Only use if connected via Browser (not for OneDrive fat client or so ever)
BTW: This is basically because we want to rollout this package just for SharePoint Collab right now and not for anything else. Later we probably will go with Hybrid AD Join and Intune and for this step im than able to use Device Based Conditional Access which makes it even more easier.
But again regarding the above 3 Requirements what would you suggest ? is this possible without ADFS Claims or do we need still the ADFS Claims ? and do i need than ADFS to connect to MFA Provider like AzureMFA or can i use the claim rules without using ADFS driven MFA and just use again Azure MFA without configuration inside ADFS ?
Hope is stated clear for you otherwise ask me anytime.
Cheers
Ueli
- Rishabh SrivastavaMay 30, 2018Iron Contributor
Hello Ueli,
As per your requirement :-
1. Only use MFA if it is outside of Corpnet
- For this feature you have to add the IP address range of your enterprise in the MFA trusted IP's range option :-
2. Only use MFA for SharePoint Online SaaS and for nothing else.
- I am not sure if there is a way where in we have implemented a policy for sharepoint and it doesn't impact onedrive. This is something which you can check by creating a test policy.
For saas applications added to your tenant, yes you can implement MFA and that too application specific.
3. Only use if connected via Browser (not for OneDrive fat client or so ever)
While creating conditional access policy you get an option where in you can use the application type.
Regards,
Rishabh
- Rishabh SrivastavaMay 30, 2018Iron Contributor
Ueli Zimmermann wrote:Thanks Rishabh,
So basically what would you recommend me if i actually don't want depend to much on ADFS and ADFS Claim Rules but would rather like to use native Conditional Access with Azure MFA ? still have ADFS in place as we are not able to remove it right away (maybe in the future i would like to go PTA and Seamless SSO) but that can go a while.
I still need the following covered:
1. Only use MFA if it is outside of Corpnet
2. Only use MFA for SharePoint Online SaaS and for nothing else
3. Only use if connected via Browser (not for OneDrive fat client or so ever)
BTW: This is basically because we want to rollout this package just for SharePoint Collab right now and not for anything else. Later we probably will go with Hybrid AD Join and Intune and for this step im than able to use Device Based Conditional Access which makes it even more easier.
But again regarding the above 3 Requirements what would you suggest ? is this possible without ADFS Claims or do we need still the ADFS Claims ? and do i need than ADFS to connect to MFA Provider like AzureMFA or can i use the claim rules without using ADFS driven MFA and just use again Azure MFA without configuration inside ADFS ?
Hope is stated clear for you otherwise ask me anytime.
Cheers
Ueli
Hello Ueli,As per your requirement :-
1. Only use MFA if it is outside of Corpnet
- For this feature you have to add the IP address range of your enterprise in the MFA trusted IP's range option :-
2. Only use MFA for SharePoint Online SaaS and for nothing else.
- I am not sure if there is a way where in we have implemented a policy for sharepoint and it doesn't impact onedrive. This is something which you can check by creating a test policy.
For saas applications added to your tenant, yes you can implement MFA and that too application specific.
3. Only use if connected via Browser (not for OneDrive fat client or so ever)
While creating conditional access policy you get an option where in you can use the application type.
Regards,
Rishabh
- Ueli ZimmermannJun 05, 2018Brass Contributor
Thank you Rishabh,
I have verified this Options as well within Conditional Access. I will check further if there was still a configuration issue on my end or if this is correct and somewhere else is the mistake.
I did configure this exactly the Way you mentioned but somehow it seems to be not apply.
Anyway i feel confident now that i understood the Process and how it should work so the issue must be somewhere around in my environment :-) will find it.
Thanks again and regards
Ueli
- Ueli ZimmermannJun 09, 2018Brass Contributor
I also found out two more things.
A) It seems that a lot of the O365 Apps are somehow integrated with SharePoint.
For Example if i just activate this Rule for SharePoint Online and only through Browser, i also have to authenticate if i want to open Word, Excel, PowerPoint, Teams, Planner etc etc. Only Yammer and some other Apps are not related to SharePoint as it seems. If i connect to Teams via Fat-Client it works without MFA as intended. Strange though that most of these Apps are SharePoint related. It also does not help if you make exclusions for let say Teams etc.
B) If enforcing MFA through Conditional Access the User does not get the Benefit of registering and using the Authenticator App on the Mobile Phone. It only reveals the Option for Phone Call and SMS even though if you would fully Deploy MFA for the User the Authenticator Method is configurable and activated on our Tenant… Seems the registration Process for Conditional Access based Auth is different (like Self Service Password Reset) This is very sad :-(
- Ueli ZimmermannJun 09, 2018Brass Contributor
Hi Rishabh,
After a while of troubleshooting i finally found the Issue.
If i choose Exclude "All trusted locations" the Rule seems not to work.
If i choose Exclude "Selected locations" and use MFA Trusted IPs for example, the Conditional Access Rule will work without further need to configure anything on ADFS like you said.
Did anybody has the same Situation / Issue ?
Cheers
Ueli