ADFS with Azure MFA and multiple Azure tenants

Amsirahc 1 Reputation point
2020-07-29T21:00:13.103+00:00

We're wanting to use Azure MFA as a second step authentication method with our 2016 ADFS environment. We have two separate Azure AD/Office 365 tenants, and several other relying party trusts in a single ADFS farm that we wish to use it with. Azure MFA is currently setup and working for Tenant A users with a custom theme that redirects if the user hasn't gone through the "ProofUp" process (based on Microsoft's documentation). It is also setup on the other RPTs to require MFA if the user is a member of a specific on-prem AD group. Tenant B users aren't currently licensed for Azure AD Premium, so we have not been able to do any testing yet.

  1. If we get the licensing worked out for Tenant B to have Azure AD Premium 1, will we be able to configure ADFS and Azure MFA to support both tenants?
  2. How would we customize the onload.js theme to capture the authArea errorMessage and forward to the appropriate Azure tenant based on the user's domain (since the instructions require the use of a domain name for the mfaRegisterUrl)?

Any feedback or recommendations would be very much appreciated.

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,187 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,388 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. KAREDD-MSFT 406 Reputation points Microsoft Employee
    2020-07-30T00:59:41.523+00:00

    In 2016 ADFS, you would have registered the ADFS to talk to a specific tenant to do the MFA. In your scenario, this is ADFS is already registered with Tenant A. So, you users in tenant B will not be able to leverage MFA through ADFS.

    If you are planning to have Azure AD premium licenses, I would recommend using CA policies and perform the MFA in Azure directly.