Forum Discussion

Michael Weber's avatar
Michael Weber
Copper Contributor
Jun 27, 2017
Solved

ADFS + Cloud MFA

I'm working with a client that has ADFS and Cloud MFA enabled.  We noticed that MFA challenges are only occurring for users going through the WAP and not the ADFS server directly.  In other words, if they're on the corporate network or VPN, MFA challenges are by-passed completely.  Now access through the WAP I think uses FBA while access from the corporate network uses Windows Integrated Auth.  Does anyone know why only off-network users are being challenged by MFA?  

Azure Active Directory (AAD)
Identity Management
  • VasilMichev's avatar
    VasilMichev
    Jun 27, 2017

    You either have added your internal network as Trusted location in the Azure MFA admin panel, or are sending the "bypass" claim with requests coming from internal sources. WIA or FBA make no difference here, you can force MFA challenge for any form of primary authentication.

2 Replies

  • VasilMichev's avatar
    VasilMichev
    MVP
    Jun 27, 2017

    You either have added your internal network as Trusted location in the Azure MFA admin panel, or are sending the "bypass" claim with requests coming from internal sources. WIA or FBA make no difference here, you can force MFA challenge for any form of primary authentication.

Resources