MFA via app on Sharepoint Online

[Erik Lundgren]

We have already protected our Netscaler login with MFA (MFA server on-prem) and the users authenticate by using the mobile app.

Now we're ready for the next step - to protect Sharepoint Online with MFA when accessing from external networks.

I know it's possible to use MFA by configure conditional access policies to accomplish that but it seems like that only gives me MFA via OTP. Am I missing something or can I use the MFA server that I already have on-prem and force users to authenticate by using the mobile app as they already know? 

[#2]

Hey @Erik Lundgren,

If you have ADFS setup locally, you could do the equivalent of conditional access policies you see in Azure AD through the ADFS server that would force MFA. You would just need to setup the proper claims rules through ADFS to get this accomplished.

https://blogs.technet.microsoft.com/bulentozkir/2016/05/01/office-365-customers-who-have-adfs-instal...

With that said, it is much more nuanced and in my opinion a bit more complicated to do this, than what Azure AD allows you to do through a few GUI based steps. 

Ultimately though YES you can do what you are asking, but you need ADFS and someone who understands the claims rule setup enough to be able to properly configure one to require MFA for SharePoint based on IP address.

At my old job, we in essence had the reveres, where we allowed IMAP connections and therefore ignored modern auth for users coming from our local offices, as our linux technicians were still running an old version of Thunderbird for their email and couldn't modern auth.

Personally I normally with my clients just do the AzureAD conditional access for that as it is much easier, but I can completely understand not wanting to switch from a current setup. - https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/technical-reference/the-role-of-claim...

Goodluck!

Adam

[#3]

The MFA server actually supports more methods than Azure MFA, including using the mobile app. It's also possible to configure it for true "passwordless" login, however as Adam mentioned below you will need to deploy AD FS in order to use it with O365 resources. If you don't have AD FS in place, this means additional cost for deployment/operation, as a minimum configuration would require 2+2 servers when done properly. On the other hand, Conditional access requires Azure AD Premium licenses for each user, and if you aren't paying for AAD Prem/EMS yet, the costs there might be even higher in the long run.

It's also important to note that Microsoft is slowly, but surely moving towards deprecating the full MFA server version and replacing it with Azure MFA, and although they haven't actually announced anything yet, I fully expect this to happen in the future.

[#4]

Thank you @Adam Ochs and @Vasil Michev for your answers.

Actually we do have ADFS in place already.

Good to know that the full MFA server is about to be deprecated. Maybe it's not a good idea to put a lot of work into it if we need to move the service later.

As far as I understand Azure MFA is also supporting the mobile app as a second factor, right?

https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-whichversion

But I haven't found anywhere to configure that. So at the moment users are using the mobile app to logon via Netscaler to the Citrix Environment and then using OTP to logon to Sharepoint online (only one test user so far). But if we just can use the mobile app instead of OTP - that would be fine.

[#5]

No no, that's just my "expectation", Microsoft has not said anything about deprecation yet, and even if they do, you will probably have few years of support left.

Keep in mind that the available primary/secondary auth factor options will differ depending on the use. Afaik those are limited for the RADIUS scenario, similarly if you want to configure Azure MFA as primary auth when using AD FS you are only given a single option.