SOLVED
Home

ADFS Claims Based Rules - I'm stuck!

%3CLINGO-SUB%20id%3D%22lingo-sub-24986%22%20slang%3D%22en-US%22%3EADFS%20Claims%20Based%20Rules%20-%20I'm%20stuck!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-24986%22%20slang%3D%22en-US%22%3E%3CP%3EIn%20my%20environment%20we%20are%20running%20Exchange%202013%20Hybrid.%20%26nbsp%3BAll%20mailboxes%20are%20in%20O365.%20%26nbsp%3BWe%20have%20certain%20requirements%20around%20our%20implementation%20that%20require%20ADFS.%20%26nbsp%3BWith%20that%20being%20said%2C%20I%20am%20really%20struggling%20with%20coming%20up%20with%20the%20set%20of%20claims%20based%20rules%20to%20accomplish%20my%20goal.%20%26nbsp%3BOur%20ADFS%20environment%20is%20in%20Azure%20(vpn%20to%20on-prem%20network%2C%201%20DC%2C%202%20ADFS%20servers%2C%202%20ADFS%20Proxy).%20%26nbsp%3BFederation%20itself%20is%20up%20and%20running%20fine.%20%26nbsp%3BI%20feel%20like%20I%20have%20read%20the%20same%20handful%20of%20technet%20%2F%20blog%20post%20articles%20on%20setting%20this%20up%20but%20I%20must%20be%20missing%20something.%20%26nbsp%3BI%20am%20also%20struggling%20with%20being%20able%20to%20debug%20%2F%20trace%20to%20see%20excatly%20which%20claims%20are%20coming%20in%20with%20their%20values%20to%20determine%20why%20I%20am%20not%20getting%20expected%20results%20%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHere%20are%20the%20scenarios%20that%20I%20need%20(and%20have%20rules%20for)%3A%3C%2FP%3E%3CP%3E1.%20%26nbsp%3BBlock%20external%20Outlook%20access%20unless%20user%20is%20in%20the%20ADFS_Allow%20External%20Outlook%20AD%20Security%20Group%3C%2FP%3E%3CPRE%3E%20exists(%5BType%20%3D%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-proxy%22%5D)%0A%20%20%26amp%3B%26amp%3B%20exists(%5BType%20%3D%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-endpoint-absolute-path%22%2C%20Value%20%3D%3D%20%22%2Fadfs%2Fservices%2Ftrust%2F2005%2Fusernamemixed%22%5D)%0A%20%20%20%26amp%3B%26amp%3B%20exists(%5BType%20%3D%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-client-application%22%2C%20Value%20%3D%3D%20%22Microsoft.Exchange.Autodiscover%7CMicrosoft.Exchange.OfflineAddressBook%7CMicrosoft.Exchange.RPC%7CMicrosoft.Exchange.WebServices%22%5D)%0A%20%20%26amp%3B%26amp%3B%20NOT%20exists(%5BType%20%3D%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-forwarded-client-ip%22%2C%20Value%20%3D~%20%22%5CbXXX%5C.XXX%5C.XXX%5C.XXX%5Cb%7C%5CbXX%5C.XX%5C.XX%5C.XX%5Cb%7C%5CbXX%5C.XX%5C.XX%5C.XX%5Cb%22%5D)%0A%20%20%26amp%3B%26amp%3B%20NOT%20exists(%5BType%20%3D%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%22%2C%20Value%20%3D~%20%22%5CbS-1-5-21-XXXX-XXXX-XXXX-XXX2%5Cb%22%5D)%0A%3D%26gt%3B%20issue(Type%20%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2Fauthorization%2Fclaims%2Fdeny%22%2C%20Value%20%3D%20%22true%22)%3B%20%3C%2FPRE%3E%3CP%3E2.%20%26nbsp%3BBlock%20external%20OWA%20unless%20user%20is%20in%20the%20ADFS_Allow%20External%20OWA%20AD%20Security%20Group%3C%2FP%3E%3CPRE%3Eexists(%5BType%20%3D%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-proxy%22%5D)%0A%20%26amp%3B%26amp%3B%20exists(%5BType%20%3D%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-endpoint-absolute-path%22%2C%20Value%20%3D%3D%20%22%2Fadfs%2Fls%22%5D)%0A%20%26amp%3B%26amp%3B%20NOT%20exists(%5BType%20%3D%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%22%2C%20Value%20%3D~%20%22%5CbS-1-5-21-XXXX-XXXX-XXX-XXX%5Cb%22%5D)%0A%20%26amp%3B%26amp%3B%20NOT%20exists(%5BType%20%3D%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-forwarded-client-ip%22%2C%20Value%20%3D~%20%22%5CbXXX%5C.XXX%5C.XXX%5C.XX%5D%5Cb%7C%5CbXX%5C.XXX%5C.XX%5C.XX%5Cb%7C%5CbXX%5C.XX%5C.XX%5C.XX%5Cb%22%5D)%0A%3D%26gt%3B%20issue(Type%20%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2Fauthorization%2Fclaims%2Fdeny%22%2C%20Value%20%3D%20%22true%22)%3B%20%3C%2FPRE%3E%3CP%3EIn%20both%20examples%20the%20IP%20addresses%20included%20in%20the%20regex%20are%20the%20public%20IP%20addresses%20of%20our%203%20locations.%20%26nbsp%3BIP%20and%20SID%20have%20been%20redacted.%20%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20looked%20at%20the%20insidecorporatenetwork%20rule%20vs%20the%20proxy%20%2F%20forwarded-client-ip%20--%20and%20either%20way%2C%20I%20can't%20seem%20to%20get%20anywhere.%20%26nbsp%3BI%20would%20really%20love%20to%20be%20able%20to%20trace%20end-to-end%20to%20view%20all%20of%20the%20claims%20and%20values%20to%20understand%20why%20someone%20is%20allowed%20%2F%20denied%20access.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20help%20in%20pointing%20me%20in%20the%20right%20direction%20would%20be%20greatly%20appreciated.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESteve%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-24986%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAuthentication%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EHybrid%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-116919%22%20slang%3D%22en-US%22%3ERe%3A%20ADFS%20Claims%20Based%20Rules%20-%20I'm%20stuck!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-116919%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20was%20what%20worked%20for%20me.%20I%20eventually%20had%20to%20use%20the%20user%20agent%20claim.%20Agreed%2C%20it%20will%20only%20cover%20Outlook%20but%20that%20works%20for%20now%2C%20will%20add%20additional%20useragents%20in%20future.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAlthough%20I%20am%20not%20sure%20at%20this%20point%2C%20it%20looks%20like%20this%20started%20affecting%20users%20on%20the%20network%20who%20had%20mailboxes%20on%20prem%20but%20archives%20in%20the%20cloud%2C%20or%20who%20had%20calendar%20sharing%20with%20users%20int%20he%20cloud%20because%20they%20continued%20to%20see%20prompts%20in%20Outlook%2C%20which%20makes%20no%20sense%20because%20all%20the%20conditions%20are%20ANDed%20and%20insidecorporatenetwork%20is%20set%20to%20false.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eexists(%5BType%20%3D%3D%20%22%3CA%20href%3D%22http%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-endpoint-absolute-path%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttp%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-endpoint-absolute-path%3C%2FA%3E%22%2C%20Value%20%3D~%20%22%2Fadfs%2F(ls%2F%7Cservices%2Ftrust%2F2005%2Fusernamemixed)%22%5D)%3CBR%20%2F%3E%26amp%3B%26amp%3B%20exists(%5BType%20%3D%3D%20%22%3CA%20href%3D%22http%3A%2F%2Fschemas.microsoft.com%2Fws%2F2012%2F01%2Finsidecorporatenetwork%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2012%2F01%2Finsidecorporatenetwork%3C%2FA%3E%22%2C%20Value%20%3D%3D%20%22false%22%5D)%3CBR%20%2F%3E%26amp%3B%26amp%3B%20exists(%5BType%20%3D%3D%20%22%3CA%20href%3D%22http%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-client-user-agent%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttp%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-client-user-agent%3C%2FA%3E%22%2C%20Value%20%3D~%20%22Outlook%22%5D)%3CBR%20%2F%3E%3D%26gt%3B%20issue(Type%20%3D%20%22%3CA%20href%3D%22http%3A%2F%2Fschemas.microsoft.com%2Fauthorization%2Fclaims%2Fdeny%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttp%3A%2F%2Fschemas.microsoft.com%2Fauthorization%2Fclaims%2Fdeny%3C%2FA%3E%22%2C%20Value%20%3D%20%22true%22)%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-44027%22%20slang%3D%22en-US%22%3ERe%3A%20ADFS%20Claims%20Based%20Rules%20-%20I'm%20stuck!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-44027%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20to%20much%20help%20from%26nbsp%3BVasil%20and%20research%20in%20Azure%20AD%20Conditonal%20Access%2C%20I%20was%20able%20to%20determine%20that%20nothing%20is%20going%20to%20prevent%20Modern%20Authentication%20clients%20at%20the%20AD%20FS%20level.%20%26nbsp%3BThere%20is%20no%26nbsp%3B%3CSPAN%3Ex-ms-client-application%20being%20presented%20by%20the%20application%20anymore%20(with%20modern%20auth).%20%26nbsp%3BInstead%20you%20have%20to%20use%20Azure%20AD%20Conditional%20Access%20which%20is%20in%20preview%20in%20the%20new%20portal.%20%26nbsp%3BIt%20seems%20to%20work%20well.%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3E%3CBR%20%2F%3EI%20used%20conditional%20access%20for%20the%20modern%20auth%20and%20for%20legacy%20auth%26nbsp%3BI%20used%20this%20claim%20rule%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%3ENOT%20exists(%5BType%20%3D%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-forwarded-client-ip%22%2C%20Value%20%3D~%20%22%5CbXXX%5C.XXX%5C.XXX%5C.XXX%5Cb%22%5D)%0A%20%26amp%3B%26amp%3B%20exists(%5BType%20%3D%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-client-application%22%2C%20Value%20%3D~%20%22Microsoft.Exchange.Mapi%7CMicrosoft.Exchange.Autodiscover%7CMicrosoft.Exchange.OfflineAddressBook%7CMicrosoft.Exchange.WebServices%22%5D)%0A%20%3D%26gt%3B%20issue(Type%20%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2Fauthorization%2Fclaims%2Fdeny%22%2C%20Value%20%3D%20%22DenyUsersWithClaim%22)%3B%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EIt%20is%20quite%20easy%20to%20see%26nbsp%3Bwhat%20is%20going%20on%20in%20the%20Security%20Log%20when%20you%20properly%20enable%20auditing%20per%20this%20article%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fjorgequestforknowledge.wordpress.com%2F2013%2F07%2F08%2Fenabling-auditing-of-issued-claims-in-adfs-v2-x-and-adfs-v3-x%2F%26nbsp%3B%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fjorgequestforknowledge.wordpress.com%2F2013%2F07%2F08%2Fenabling-auditing-of-issued-claims-in-adfs-v2-x-and-adfs-v3-x%2F%3C%2FA%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3ELook%20for%20EventIDs%2C%20299%2C%20500%20%26amp%3B%20501%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EThis%20way%20you%20can%20adjust%20your%20claim%20rules%20to%20your%20environment.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3E%3CBR%20%2F%3EHope%20this%20helps!%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-44026%22%20slang%3D%22en-US%22%3ERe%3A%20ADFS%20Claims%20Based%20Rules%20-%20I'm%20stuck!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-44026%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20best%20way%20to%20troubleshoot%20ADFS%20claims%20is%20with%20fidler.%20Fidler%20can%20catch%20your%20certificate%20thumbprint%20so%20you%20can%20see%20the%20claims%20which%20are%20communicating.%20If%20you%20are%20doing%20this%20make%20sure%20you%20have%20your%20ADFS%2C%20and%20party%20trust%20in%20the%20right%20order.%20Then%20you%20go%20to%20the%20page%20%3CA%20href%3D%22https%3A%2F%2Fadfs.domain.nl%2Fadfs%2Fls%2FIdpInitiatedSignOn.aspx%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fadfs.domain.nl%2Fadfs%2Fls%2FIdpInitiatedSignOn.aspx%3C%2FA%3E%20and%20logon%20with%20an%20account%20that%20needs%20SSO.%20Make%20sure%20Fidler%20runs%20%3CSPAN%20class%3D%22st%22%3Esimultaneously%20and%20catches%20your%20data.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-44021%22%20slang%3D%22en-US%22%3ERe%3A%20ADFS%20Claims%20Based%20Rules%20-%20I'm%20stuck!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-44021%22%20slang%3D%22en-US%22%3E%3CP%3EI'm%20working%20on%20this%20exact%20same%20problem.%20Discouraging%20to%20see%20there%20is%20no%20accepted%20solution.%20Also%20using%20ADFS%203.0%20with%20WAP%2C%20Outlook%202016%20and%20modern%20auth.%20Need%20a%20solution%20to%20this%20MS!%20I'll%20let%20you%20know%20what%20we%20find%20as%20it's%20high%20priority%20for%20us.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-39396%22%20slang%3D%22en-US%22%3ERe%3A%20ADFS%20Claims%20Based%20Rules%20-%20I'm%20stuck!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-39396%22%20slang%3D%22en-US%22%3E%3CP%3EKevin%20--%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20never%20got%20it%20to%20work%20-%20but%20to%20be%20honest%2C%20I%20had%20to%20put%20it%20down%20and%20work%20on%20other%2C%20higher%20priority%20projects.%20%26nbsp%3BThat%20being%20said%20-%20I%20had%20a%20rule%20that%20seemed%20to%20work%20*sometimes*%2C%20and%20I%20couldn't%20pin%20down%20exactly%20what%20was%20going%20on.%20%26nbsp%3BI%20did%20learn%20a%20lot%20about%20reading%20the%20logs%20and%20I%20intend%20to%20pick%20this%20up%20again%20in%20the%20future.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20believe%20this%20is%20where%20I%20left%20off%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%3Eexists(%5BType%20%3D%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2Fws%2F2012%2F01%2Finsidecorporatenetwork%22%2C%20Value%20%3D%3D%20%22false%22%5D)%0A%26amp%3B%26amp%3B%20NOT%20exists(%5BType%20%3D%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%22%2C%20Value%20%3D~%20%22S-1-5-21-xxx-xxx-xxx-xxxx%22%5D)%0A%26amp%3B%26amp%3B%20exists(%5BType%20%3D%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-endpoint-absolute-path%22%2C%20Value%20%3D%3D%20%22%2Fadfs%2Fservices%2Ftrust%2F2005%2Fusernamemixed%22%5D)%0A%26amp%3B%26amp%3B%20exists(%5BType%20%3D%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-client-application%22%2C%20Value%20%3D%3D%20%22%3F%3F%3F%3F%3F%3F%3F%22%5D)%0A%3D%26gt%3B%20issue(Type%20%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2Fauthorization%2Fclaims%2Fdeny%22%2C%20Value%20%3D%20%22true%22)%3B%3C%2FPRE%3E%3CP%3EI%20believe%20the%20x-ms-client-application%20should%20be%20Microsoft.Exchange.RPC%20OR%20Microsoft.Exchange.ActiveSync%20(not%20sure%20on%20the%20case)%2C%20OR%20Microsoft.Exchange.Autodiscover%20(not%20sure%20on%20case)%2C%20OR%20Microsoft.Exchange.Webservices.%20%26nbsp%3BI%20just%20never%20got%20the%20syntax%20quite%20right.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAlso%20-%20my%20clients%20are%20not%20using%20modern%20authentication.%20%26nbsp%3BLast%20I%20knew%2C%20all%20modern%20authentication%20traffic%20presented%20itself%20to%20the%20adfs%2Fls%20endpoint%20and%20thus%20-%20you%20could%20not%20decipher%20active%20from%20passive%20connections.%20%26nbsp%3BMaybe%20that%20has%20changed%20in%20the%20past%20couple%20of%20months%3F!%3F!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20this%20helps%20or%20you%20end%20up%20getting%20the%20rule%20right%20-%20please%20let%20me%20know.%20%26nbsp%3BI%20would%20love%20ot%20have%20someone%20working%20in%20toward%20the%20same%20goal%20to%20bounce%20ideas%20off%20of.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3CP%3Esb%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-39391%22%20slang%3D%22en-US%22%3ERe%3A%20ADFS%20Claims%20Based%20Rules%20-%20I'm%20stuck!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-39391%22%20slang%3D%22en-US%22%3E%3CP%3EStephen%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWere%20you%20ever%20able%20to%20%22%3CSPAN%3EBlock%20external%20Outlook%20access%20unless%20user%20is%20in%20the%20ADFS_Allow%20External%20Outlook%20AD%20Security%20Group%22%3F%20%26nbsp%3BIf%20so%2C%20would%20you%20be%20able%20to%20share%20the%20syntax%20you%20used%20to%20accomplish%20the%20task%20please%3F%20%26nbsp%3BAlso%2C%20is%20Modern%20Authentication%20enbled%20in%20your%20tenant%3F%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EThank%20you%2C%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EKevin%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-26908%22%20slang%3D%22en-US%22%3ERe%3A%20ADFS%20Claims%20Based%20Rules%20-%20I'm%20stuck!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-26908%22%20slang%3D%22en-US%22%3E%3CP%3ELooks%20like%20I%20finally%20got%20this%20-%20turns%20out%20I%20was%20missing%20a%20%22%2F%22%20on%20the%20%22%2Fadfs%2Fls%22%20portion%20of%20the%20rule.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%3Eexists(%5BType%20%3D%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2Fws%2F2012%2F01%2Finsidecorporatenetwork%22%2C%20Value%20%3D%3D%20%22false%22%5D)%0A%20%26amp%3B%26amp%3B%20NOT%20exists(%5BType%20%3D%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%22%2C%20Value%20%3D~%20%22S-1-5-21-XXX-XXX-XXX-2107%22%5D)%0A%20%26amp%3B%26amp%3B%20exists(%5BType%20%3D%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-endpoint-absolute-path%22%2C%20Value%20%3D%3D%20%22%2Fadfs%2Fls%2F%22%5D)%0A%20%3D%26gt%3B%20issue(Type%20%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2Fauthorization%2Fclaims%2Fdeny%22%2C%20Value%20%3D%20%22true%22)%3B%3C%2FPRE%3E%3CP%3EThank%20you%20for%20your%20help%20with%20this.%20%26nbsp%3BNow%20on%20to%20doing%20the%20same%20thing%20with%20outlook%20access%3C%2FP%3E%3CP%3ESteve%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-25641%22%20slang%3D%22en-US%22%3ERe%3A%20ADFS%20Claims%20Based%20Rules%20-%20I'm%20stuck!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-25641%22%20slang%3D%22en-US%22%3E%3CP%3EThere%20seems%20to%20be%20an%20extra%20bracket%20in%20the%20rule%20you%20entered%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EValue%20%3D~%20%22%5Cb1XX.XXX.XX.4%5D%5Cb%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAlso%2C%20try%20doing%20exact%20match%20agains%20the%20group%20SID%2C%20for%20example%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eexists(%5BType%20%3D%3D%20%22%3CA%20href%3D%22http%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CFONT%20color%3D%22%230066cc%22%3Ehttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%3C%2FFONT%3E%3C%2FA%3E%22%2C%20Value%20%3D%3D%20%22S-1-5-21-....%22%5D)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ELastly%2C%20I'd%20recommend%20avoiding%20the%20use%20of%20both%20insidecorporatenetwork%20and%20x-ms-forwarded-client-ip%20in%20the%20same%20rule.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-25605%22%20slang%3D%22en-US%22%3ERe%3A%20ADFS%20Claims%20Based%20Rules%20-%20I'm%20stuck!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-25605%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20had%20some%20success%20with%20using%20insidecorporatenetwork%20and%20as%20a%20result%20I%20am%20trying%20to%20re-engineer%20my%20rules.%20%26nbsp%3BI%20am%20currently%20trying%20to%20block%20OWA%20for%20users%20outside%20our%20walls%20and%20NOT%20in%20a%20specific%20security%20group.%20%26nbsp%3BI%20am%20not%20having%20luck.%20%26nbsp%3BHere%20is%20my%20rule%3A%3C%2FP%3E%3CPRE%3Eexists(%5BType%20%3D%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2Fws%2F2012%2F01%2Finsidecorporatenetwork%22%2C%20Value%20%3D%3D%20%22false%22%5D)%0A%20%26amp%3B%26amp%3B%20NOT%20exists(%5BType%20%3D%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-forwarded-client-ip%22%2C%20Value%20%3D~%20%22%5Cb1XX.XXX.XX.4%5D%5Cb%22%5D)%0A%20%26amp%3B%26amp%3B%20exists(%5BType%20%3D%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-endpoint-absolute-path%22%2C%20Value%20%3D%3D%20%22%2Fadfs%2Fls%22%5D)%0A%20%26amp%3B%26amp%3B%20NOT%20exists(%5BType%20%3D%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%22%2C%20Value%20%3D~%20%22%5CbS-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-2107%5Cb%22%5D)%0A%20%3D%26gt%3B%20issue(Type%20%3D%20%22http%3A%2F%2Fschemas.microsoft.com%2Fauthorization%2Fclaims%2Fdeny%22%2C%20Value%20%3D%20%22true%22)%3B%3C%2FPRE%3E%3CP%3EThe%20user%20I%20am%20testing%20with%20is%20not%20a%20member%20of%20my%20Allow%20OWA%20group%2C%20and%20therefore%20I%20would%26nbsp%3Bexpect%20the%20attempt%20to%20fail.%20%26nbsp%3BIf%20I%20look%20in%20my%20event%20log%20here%20is%20what%20I%20see%20for%20this%20particular%20authentication%20attempt%20-%20which%20succeeds.%3C%2FP%3E%3CP%3EThese%20are%20all%20event%20id%20500%20or%20501%3A%3C%2FP%3E%3CPRE%3E%20Issued%20identity%3A%20%0Ahttp%3A%2F%2Fschemas.xmlsoap.org%2Fclaims%2FUPN%20%0Ashelleyc%40mycompany.com%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2FLiveID%2FFederation%2F2008%2F05%2FImmutableID%20%0A%26lt%3Bredacted%26gt%3B%20%0Ahttp%3A%2F%2Fschemas.xmlsoap.org%2Fws%2F2005%2F05%2Fidentity%2Fclaims%2Fnameidentifier%20%0A%26lt%3Bredacted%26gt%3B%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fauthenticationinstant%20%0A2016-10-28T18%3A16%3A55.203Z%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fauthenticationmethod%20%0Aurn%3Aoasis%3Anames%3Atc%3ASAML%3A2.0%3Aac%3Aclasses%3APasswordProtectedTransport%20%0A%0ACaller%20identity%3A%20%0Ahttp%3A%2F%2Fschemas.xmlsoap.org%2Fws%2F2005%2F05%2Fidentity%2Fclaims%2Fimplicitupn%20%0Ashelleyc%40mycompany.local%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fauthenticationmethod%20%0Aurn%3Aoasis%3Anames%3Atc%3ASAML%3A2.0%3Aac%3Aclasses%3APasswordProtectedTransport%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fauthenticationinstant%20%0A2016-10-28T18%3A16%3A55.203Z%20%0Ahttp%3A%2F%2Fschemas.xmlsoap.org%2Fws%2F2005%2F05%2Fidentity%2Fclaims%2Fupn%20%0Ashelleyc%40mycompany.com%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fprimarygroupsid%20%0AS-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-513%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fprimarysid%20%0AS-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-2104%20%0Ahttp%3A%2F%2Fschemas.xmlsoap.org%2Fws%2F2005%2F05%2Fidentity%2Fclaims%2Fname%20%0Amycompany%5Cshelleyc%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fwindowsaccountname%20%0Amycompany%5Cshelleyc%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fclaims%2Fauthnmethodsreferences%20%0Aurn%3Aoasis%3Anames%3Atc%3ASAML%3A2.0%3Aac%3Aclasses%3APasswordProtectedTransport%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-513%0A%0ACaller%20identity%3A%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fclient-request-id%20%0A1f08feb8-927f-4e6f-ad8a-0859da3a4398%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Frelyingpartytrustid%20%0Ahttps%3A%2F%2Flogin.microsoftonline.com%2Flogin.srf%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-forwarded-client-ip%20%0A66.XXX.XX.19%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-forwarded-client-ip%20%0A66.XXX.XX.19%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-client-ip%20%0A40.XXX.XXX.225%20%0A-%20%0A-%20%0A-%20%0A-%20%0A-%20%0A-%20%0A-%20%0A-%20%0A-%20%0A-%0A%0ACaller%20identity%3A%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-1-0%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-5-32-545%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-5-2%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-5-11%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-5-15%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-18-2%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-client-user-agent%20%0AMozilla%2F5.0%20(Windows%20NT%206.3%3B%20WOW64%3B%20Trident%2F7.0%3B%20rv%3A11.0)%20like%20Gecko%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-endpoint-absolute-path%20%0A%2Fadfs%2Fls%2F%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2012%2F01%2Finsidecorporatenetwork%20%0Afalse%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2F2012%2F01%2Frequestcontext%2Fclaims%2Fx-ms-proxy%20%0Asic-wap-a%0A%0ACaller%20identity%3A%20%0Ahttp%3A%2F%2Fschemas.xmlsoap.org%2Fws%2F2005%2F05%2Fidentity%2Fclaims%2Fimplicitupn%20%0Ashelleyc%40mycompany.local%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fauthenticationmethod%20%0Aurn%3Aoasis%3Anames%3Atc%3ASAML%3A2.0%3Aac%3Aclasses%3APasswordProtectedTransport%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fauthenticationinstant%20%0A2016-10-28T18%3A16%3A55.203Z%20%0Ahttp%3A%2F%2Fschemas.xmlsoap.org%2Fws%2F2005%2F05%2Fidentity%2Fclaims%2Fupn%20%0Ashelleyc%40mycompany.com%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fprimarygroupsid%20%0AS-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-513%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fprimarysid%20%0AS-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-2104%20%0Ahttp%3A%2F%2Fschemas.xmlsoap.org%2Fws%2F2005%2F05%2Fidentity%2Fclaims%2Fname%20%0Amycompany%5Cshelleyc%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fwindowsaccountname%20%0Amycompany%5Cshelleyc%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fclaims%2Fauthnmethodsreferences%20%0Aurn%3Aoasis%3Anames%3Atc%3ASAML%3A2.0%3Aac%3Aclasses%3APasswordProtectedTransport%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-513%0A%0ACaller%20identity%3A%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-1-0%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-5-32-545%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-5-2%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-5-11%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-5-15%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-18-2%20%0A-%20%0A-%20%0A-%20%0A-%20%0A-%20%0A-%20%0A-%20%0A-%0A%0AIssued%20identity%3A%20%0Ahttp%3A%2F%2Fschemas.xmlsoap.org%2Fws%2F2005%2F05%2Fidentity%2Fclaims%2Fimplicitupn%20%0Ashelleyc%40mycompany.local%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fauthenticationmethod%20%0Aurn%3Aoasis%3Anames%3Atc%3ASAML%3A2.0%3Aac%3Aclasses%3APasswordProtectedTransport%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fauthenticationinstant%20%0A2016-10-28T18%3A16%3A55.203Z%20%0Ahttp%3A%2F%2Fschemas.xmlsoap.org%2Fws%2F2005%2F05%2Fidentity%2Fclaims%2Fupn%20%0Ashelleyc%40mycompany.com%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fprimarygroupsid%20%0AS-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-513%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-513%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-1-0%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-5-32-545%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-5-2%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-5-11%0A%0AIssued%20identity%3A%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-5-15%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-18-1%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fprimarysid%20%0AS-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-2104%20%0Ahttp%3A%2F%2Fschemas.xmlsoap.org%2Fws%2F2005%2F05%2Fidentity%2Fclaims%2Fname%20%0Amycompany%5Cshelleyc%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fwindowsaccountname%20%0Amycompany%5Cshelleyc%20%0A-%20%0A-%20%0A-%20%0A-%20%0A-%20%0A-%20%0A-%20%0A-%20%0A-%20%0A%0ACaller%20identity%3A%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fwindowsaccountname%20%0Amycompany%5Cshelleyc%20%0Ahttp%3A%2F%2Fschemas.xmlsoap.org%2Fws%2F2005%2F05%2Fidentity%2Fclaims%2Fupn%20%0Ashelleyc%40mycompany.com%20%0A%0ACaller%20identity%3A%20%0Ahttp%3A%2F%2Fschemas.xmlsoap.org%2Fws%2F2005%2F05%2Fidentity%2Fclaims%2Fname%20%0Amycompany%5Cshelleyc%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fprimarysid%20%0AS-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-2104%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fprimarygroupsid%20%0AS-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-513%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-513%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-1-0%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-5-32-545%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-5-2%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-5-11%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-5-15%20%0Ahttp%3A%2F%2Fschemas.microsoft.com%2Fws%2F2008%2F06%2Fidentity%2Fclaims%2Fgroupsid%20%0AS-1-18-1%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20missing%20piece%20is%20this%20user%20does%20not%20match%20the%20groupsid%20in%20the%20rule%20-%20which%20I%20would%20expect%20to%20issue%20a%20deny%3F%3F%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3CP%3ESteve%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-25170%22%20slang%3D%22en-US%22%3ERe%3A%20ADFS%20Claims%20Based%20Rules%20-%20I'm%20stuck!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-25170%22%20slang%3D%22en-US%22%3E%3CP%3EModern%20auth%20is%20enabled%20by%20default%20on%20Office%202016%2C%20so%20definitely%20check%20for%20that.%20But%20yes.%20the%20first%20priority%20should%20be%20changing%20the%20rules%20to%20use%20insidecorporatenetwork%20if%20you%20are%20on%202012%20R2.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-25098%22%20slang%3D%22en-US%22%3ERe%3A%20ADFS%20Claims%20Based%20Rules%20-%20I'm%20stuck!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-25098%22%20slang%3D%22en-US%22%3E%3CP%3EThank%20you%20for%20the%20response!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMy%20clients%20are%20running%20Office%202013%20(not%20sure%20on%20service%20pack%20version)%20OR%20%26nbsp%3Bsome%20Office%202016.%20%26nbsp%3BI%20do%20not%20believe%20that%20I%20have%20Modern%20Authentication%20turned%20on%20because%20I%20knew%20that%20everything%20would%20present%20itself%20as%20passive.%20%26nbsp%3BI%20figured%20I%20would%20cross%20that%20bridge%20once%20I%20got%20my%20entire%20environment%20to%20v2016.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMy%20servers%20are%202012%20R2.%20%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20been%20looking%20at%20my%20event%20logs%20and%20cannot%20see%20what%20I%20would%20expect%20to%20see.%20%26nbsp%3BMay%20have%20to%20do%20with%20the%20proxy%20vs%20insidecorporatenetwork.%20%26nbsp%3BI%20will%20give%20this%20a%20shot%20and%20post%20back.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%20again%3C%2FP%3E%3CP%3ESteve%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-25092%22%20slang%3D%22en-US%22%3ERe%3A%20ADFS%20Claims%20Based%20Rules%20-%20I'm%20stuck!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-25092%22%20slang%3D%22en-US%22%3E%3CP%3EWhich%20version%20are%20you%20using%3F%20x-ms-proxy%20only%20works%20with%20the%202008%20R2%20version%2C%20if%20you%20are%20on%202012%20R2%20you%20should%20use%20%3CEM%3Einsidecorporatenetwork%3C%2FEM%3E.%20If%20your%20clients%20are%20Office%202016%2FOffice%202013%20SP1%2C%20you%20most%20likely%20have%20modern%20authentication%20enabled%20and%20all%26nbsp%3Btraffic%20will%20be%20hitting%20the%20passive%20endopoint%20(%2Fadfs%2Fls)%2C%20so%20you%20should%20account%20for%20this.%20To%20monitor%20the%20rules%2C%20check%20your%20event%20logs%20(assuming%20auditing%20is%20enabled%20for%20AD%20FS).%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-25002%22%20slang%3D%22en-US%22%3ERe%3A%20ADFS%20Claims%20Based%20Rules%20-%20I'm%20stuck!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-25002%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F130%22%20target%3D%22_blank%22%3E%40Trevor%20Seward%3C%2FA%3E%26nbsp%3Bgave%20a%20presentation%20on%20configuring%20ADFS%20in%20Azure%20yesterday%2C%20he%20may%20be%20able%20to%20offer%20some%20assistance.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Stephen Bell
Contributor

In my environment we are running Exchange 2013 Hybrid.  All mailboxes are in O365.  We have certain requirements around our implementation that require ADFS.  With that being said, I am really struggling with coming up with the set of claims based rules to accomplish my goal.  Our ADFS environment is in Azure (vpn to on-prem network, 1 DC, 2 ADFS servers, 2 ADFS Proxy).  Federation itself is up and running fine.  I feel like I have read the same handful of technet / blog post articles on setting this up but I must be missing something.  I am also struggling with being able to debug / trace to see excatly which claims are coming in with their values to determine why I am not getting expected results  

 

Here are the scenarios that I need (and have rules for):

1.  Block external Outlook access unless user is in the ADFS_Allow External Outlook AD Security Group

	exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-proxy"])
	 && exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-endpoint-absolute-path", Value == "/adfs/services/trust/2005/usernamemixed"])
		 && exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-application", Value == "Microsoft.Exchange.Autodiscover|Microsoft.Exchange.OfflineAddressBook|Microsoft.Exchange.RPC|Microsoft.Exchange.WebServices"])
	 && NOT exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip", Value =~ "\bXXX\.XXX\.XXX\.XXX\b|\bXX\.XX\.XX\.XX\b|\bXX\.XX\.XX\.XX\b"])
	 && NOT exists([Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", Value =~ "\bS-1-5-21-XXXX-XXXX-XXXX-XXX2\b"])
=> issue(Type = "http://schemas.microsoft.com/authorization/claims/deny", Value = "true"); 

2.  Block external OWA unless user is in the ADFS_Allow External OWA AD Security Group

exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-proxy"])
 && exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-endpoint-absolute-path", Value == "/adfs/ls"])
 && NOT exists([Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", Value =~ "\bS-1-5-21-XXXX-XXXX-XXX-XXX\b"])
 && NOT exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip", Value =~ "\bXXX\.XXX\.XXX\.XX]\b|\bXX\.XXX\.XX\.XX\b|\bXX\.XX\.XX\.XX\b"])
=> issue(Type = "http://schemas.microsoft.com/authorization/claims/deny", Value = "true"); 

In both examples the IP addresses included in the regex are the public IP addresses of our 3 locations.  IP and SID have been redacted.  

 

I have looked at the insidecorporatenetwork rule vs the proxy / forwarded-client-ip -- and either way, I can't seem to get anywhere.  I would really love to be able to trace end-to-end to view all of the claims and values to understand why someone is allowed / denied access.

 

Any help in pointing me in the right direction would be greatly appreciated.

 

Steve

13 Replies

@Trevor Seward gave a presentation on configuring ADFS in Azure yesterday, he may be able to offer some assistance.

Solution

Which version are you using? x-ms-proxy only works with the 2008 R2 version, if you are on 2012 R2 you should use insidecorporatenetwork. If your clients are Office 2016/Office 2013 SP1, you most likely have modern authentication enabled and all traffic will be hitting the passive endopoint (/adfs/ls), so you should account for this. To monitor the rules, check your event logs (assuming auditing is enabled for AD FS).

Thank you for the response!

 

My clients are running Office 2013 (not sure on service pack version) OR  some Office 2016.  I do not believe that I have Modern Authentication turned on because I knew that everything would present itself as passive.  I figured I would cross that bridge once I got my entire environment to v2016.

 

My servers are 2012 R2.  

 

I have been looking at my event logs and cannot see what I would expect to see.  May have to do with the proxy vs insidecorporatenetwork.  I will give this a shot and post back.

 

Thank you again

Steve

Modern auth is enabled by default on Office 2016, so definitely check for that. But yes. the first priority should be changing the rules to use insidecorporatenetwork if you are on 2012 R2.

I have had some success with using insidecorporatenetwork and as a result I am trying to re-engineer my rules.  I am currently trying to block OWA for users outside our walls and NOT in a specific security group.  I am not having luck.  Here is my rule:

exists([Type == "http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork", Value == "false"])
 && NOT exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip", Value =~ "\b1XX.XXX.XX.4]\b"])
 && exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-endpoint-absolute-path", Value == "/adfs/ls"])
 && NOT exists([Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", Value =~ "\bS-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-2107\b"])
 => issue(Type = "http://schemas.microsoft.com/authorization/claims/deny", Value = "true");

The user I am testing with is not a member of my Allow OWA group, and therefore I would expect the attempt to fail.  If I look in my event log here is what I see for this particular authentication attempt - which succeeds.

These are all event id 500 or 501:

 Issued identity: 
http://schemas.xmlsoap.org/claims/UPN 
shelleyc@mycompany.com 
http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID 
<redacted> 
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier 
<redacted> 
http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationinstant 
2016-10-28T18:16:55.203Z 
http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod 
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport 

Caller identity: 
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/implicitupn 
shelleyc@mycompany.local 
http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod 
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport 
http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationinstant 
2016-10-28T18:16:55.203Z 
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn 
shelleyc@mycompany.com 
http://schemas.microsoft.com/ws/2008/06/identity/claims/primarygroupsid 
S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-513 
http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid 
S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-2104 
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name 
mycompany\shelleyc 
http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname 
mycompany\shelleyc 
http://schemas.microsoft.com/claims/authnmethodsreferences 
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-513

Caller identity: 
http://schemas.microsoft.com/2012/01/requestcontext/claims/client-request-id 
1f08feb8-927f-4e6f-ad8a-0859da3a4398 
http://schemas.microsoft.com/2012/01/requestcontext/claims/relyingpartytrustid 
https://login.microsoftonline.com/login.srf 
http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip 
66.XXX.XX.19 
http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip 
66.XXX.XX.19 
http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-ip 
40.XXX.XXX.225 
- 
- 
- 
- 
- 
- 
- 
- 
- 
-

Caller identity: 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-1-0 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-5-32-545 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-5-2 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-5-11 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-5-15 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-18-2 
http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-user-agent 
Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko 
http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-endpoint-absolute-path 
/adfs/ls/ 
http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork 
false 
http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-proxy 
sic-wap-a

Caller identity: 
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/implicitupn 
shelleyc@mycompany.local 
http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod 
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport 
http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationinstant 
2016-10-28T18:16:55.203Z 
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn 
shelleyc@mycompany.com 
http://schemas.microsoft.com/ws/2008/06/identity/claims/primarygroupsid 
S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-513 
http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid 
S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-2104 
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name 
mycompany\shelleyc 
http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname 
mycompany\shelleyc 
http://schemas.microsoft.com/claims/authnmethodsreferences 
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-513

Caller identity: 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-1-0 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-5-32-545 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-5-2 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-5-11 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-5-15 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-18-2 
- 
- 
- 
- 
- 
- 
- 
-

Issued identity: 
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/implicitupn 
shelleyc@mycompany.local 
http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod 
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport 
http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationinstant 
2016-10-28T18:16:55.203Z 
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn 
shelleyc@mycompany.com 
http://schemas.microsoft.com/ws/2008/06/identity/claims/primarygroupsid 
S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-513 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-513 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-1-0 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-5-32-545 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-5-2 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-5-11

Issued identity: 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-5-15 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-18-1 
http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid 
S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-2104 
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name 
mycompany\shelleyc 
http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname 
mycompany\shelleyc 
- 
- 
- 
- 
- 
- 
- 
- 
- 

Caller identity: 
http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname 
mycompany\shelleyc 
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn 
shelleyc@mycompany.com 

Caller identity: 
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name 
mycompany\shelleyc 
http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid 
S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-2104 
http://schemas.microsoft.com/ws/2008/06/identity/claims/primarygroupsid 
S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-513 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-513 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-1-0 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-5-32-545 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-5-2 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-5-11 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-5-15 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 
S-1-18-1

 

The missing piece is this user does not match the groupsid in the rule - which I would expect to issue a deny???

 

Thanks

Steve

 

There seems to be an extra bracket in the rule you entered:

 

Value =~ "\b1XX.XXX.XX.4]\b"

 

Also, try doing exact match agains the group SID, for example:

 

exists([Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", Value == "S-1-5-21-...."])

 

Lastly, I'd recommend avoiding the use of both insidecorporatenetwork and x-ms-forwarded-client-ip in the same rule.

Looks like I finally got this - turns out I was missing a "/" on the "/adfs/ls" portion of the rule.

 

exists([Type == "http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork", Value == "false"])
 && NOT exists([Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", Value =~ "S-1-5-21-XXX-XXX-XXX-2107"])
 && exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-endpoint-absolute-path", Value == "/adfs/ls/"])
 => issue(Type = "http://schemas.microsoft.com/authorization/claims/deny", Value = "true");

Thank you for your help with this.  Now on to doing the same thing with outlook access

Steve

Stephen,

 

Were you ever able to "Block external Outlook access unless user is in the ADFS_Allow External Outlook AD Security Group"?  If so, would you be able to share the syntax you used to accomplish the task please?  Also, is Modern Authentication enbled in your tenant?

 

Thank you,

 

Kevin

Kevin --

 

I never got it to work - but to be honest, I had to put it down and work on other, higher priority projects.  That being said - I had a rule that seemed to work *sometimes*, and I couldn't pin down exactly what was going on.  I did learn a lot about reading the logs and I intend to pick this up again in the future.

 

I believe this is where I left off:

 

exists([Type == "http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork", Value == "false"])
&& NOT exists([Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", Value =~ "S-1-5-21-xxx-xxx-xxx-xxxx"])
&& exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-endpoint-absolute-path", Value == "/adfs/services/trust/2005/usernamemixed"])
&& exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-application", Value == "???????"])
=> issue(Type = "http://schemas.microsoft.com/authorization/claims/deny", Value = "true");

I believe the x-ms-client-application should be Microsoft.Exchange.RPC OR Microsoft.Exchange.ActiveSync (not sure on the case), OR Microsoft.Exchange.Autodiscover (not sure on case), OR Microsoft.Exchange.Webservices.  I just never got the syntax quite right.

 

Also - my clients are not using modern authentication.  Last I knew, all modern authentication traffic presented itself to the adfs/ls endpoint and thus - you could not decipher active from passive connections.  Maybe that has changed in the past couple of months?!?!

 

If this helps or you end up getting the rule right - please let me know.  I would love ot have someone working in toward the same goal to bounce ideas off of.

 

Thanks

sb

I'm working on this exact same problem. Discouraging to see there is no accepted solution. Also using ADFS 3.0 with WAP, Outlook 2016 and modern auth. Need a solution to this MS! I'll let you know what we find as it's high priority for us.

The best way to troubleshoot ADFS claims is with fidler. Fidler can catch your certificate thumbprint so you can see the claims which are communicating. If you are doing this make sure you have your ADFS, and party trust in the right order. Then you go to the page https://adfs.domain.nl/adfs/ls/IdpInitiatedSignOn.aspx and logon with an account that needs SSO. Make sure Fidler runs simultaneously and catches your data.

Thanks to much help from Vasil and research in Azure AD Conditonal Access, I was able to determine that nothing is going to prevent Modern Authentication clients at the AD FS level.  There is no x-ms-client-application being presented by the application anymore (with modern auth).  Instead you have to use Azure AD Conditional Access which is in preview in the new portal.  It seems to work well. 


I used conditional access for the modern auth and for legacy auth I used this claim rule

 

NOT exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip", Value =~ "\bXXX\.XXX\.XXX\.XXX\b"])
 && exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-application", Value =~ "Microsoft.Exchange.Mapi|Microsoft.Exchange.Autodiscover|Microsoft.Exchange.OfflineAddressBook|Microsoft.Exchange.WebServices"])
 => issue(Type = "http://schemas.microsoft.com/authorization/claims/deny", Value = "DenyUsersWithClaim");

 

It is quite easy to see what is going on in the Security Log when you properly enable auditing per this article https://jorgequestforknowledge.wordpress.com/2013/07/08/enabling-auditing-of-issued-claims-in-adfs-v...

 

Look for EventIDs, 299, 500 & 501

 

This way you can adjust your claim rules to your environment.


Hope this helps!

This was what worked for me. I eventually had to use the user agent claim. Agreed, it will only cover Outlook but that works for now, will add additional useragents in future.

 

Although I am not sure at this point, it looks like this started affecting users on the network who had mailboxes on prem but archives in the cloud, or who had calendar sharing with users int he cloud because they continued to see prompts in Outlook, which makes no sense because all the conditions are ANDed and insidecorporatenetwork is set to false.

 

exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-endpoint-absolute-path", Value =~ "/adfs/(ls/|services/trust/2005/usernamemixed)"])
&& exists([Type == "http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork", Value == "false"])
&& exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-user-agent", Value =~ "Outlook"])
=> issue(Type = "http://schemas.microsoft.com/authorization/claims/deny", Value = "true");

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
17 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
flashing a white screen while open new tab
cntvertex in Discussions on
11 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
28 Replies