Forum Discussion
365 MFA ADFS Bypass
Thanks, it is that i am after assistance with
Does the order take priority ?
Basically i require something that does not enforce mfa for skype, activesync, not all users at the moment are mfa, everything i been looking at enforces mfa unless it matches X
There are many example rules that do that, just look at the documentation. For example, this article:https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/access-control-policies-w2k12
And here's a sample rule we used with one of my customers back in the day:
NOT exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip", Value =~ "insert_list_of_IP_addresses_here"]) && NOT exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-endpoint-absolute-path", Value == "/adfs/ls/"]) && NOT exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-application", Value == "Microsoft.Exchange.ActiveSync"]) && NOT exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-user-agent", Value =~ "lync|ucmapi|WLMHttpTransport|Lync"]) => issue(Type = "http://schemas.microsoft.com/authorization/claims/deny", Value = "true");
VasilMichev Hi Vasil, is there a way to bypass MFA (3rd party) only for Intune and for rest of the M365 apps (SharePoint, Teams etc.) it works in a normal way. If yes, can please provide an example for claim rules for the same. Thanks.
