Setting up ADFS with Azure MFA

Question

Hello, we are setting up Azure MFA with ADFS. I have implemented a Conditional Access policy to require users to use MFA. However, when users log in they are not prompted to enroll in MFA, but instead it looks like ADFS is passing off to Azure that the user has already passed MFA.

In the Sign in Logs I'm seeing these two messages:
"MFA requirement satisfied by claim in the token"
and
"MFA requirement satisfied by claim provided by external provider"

I am not integrating Azure MFA within ADFS, I'm letting MFA happen all on O365 as I found the sign up process clunky for end users. Is there a way to have the user log in through ADFS and then get prompted for Azure MFA?

Answer 1

Hi @Dan Chandler-Klein ,

I think you will have to enable the protection security policy and this will setup the MFA authentication requirement via ADFS. Check the process over here and hope this helps.

best-practices-securing-ad-fs

==
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Thanks. From what I'm reading this would prompt all our users for MFA in Azure though, correct? Half our users are on Duo and so we're specifying that only a subset of users get Azure MFA. We don't want the Duo users getting prompted twice

Answer 3

How is this configured in ADFS and in the Azure CA Policy?

Seems to me you would exclude a synced group from on-prem ADFS for MFA, then use that same group in Azure in a CA policy that requires MFA.

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/adfs-excluding-a-specific-user-group-from-mfa/ba-p/258813