ADFS additional authentication rule -> access control rule

Question

On our ADFS 2016 farm we have a global additional authentication rule which I would like to change to an RPT-specific access control rule to have more flexibility.
The current additional authentication rule is:

exists([Type == "http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork", Value == "false"])
&& NOT exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip", Value =~ "\b123.45.67.89\b"])
=> issue(Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod", Value = "http://schemas.microsoft.com/claims/multipleauthn");

Additionally, I would like to add an AD group as an exclusion in this rule, lets call it: "no_mfa".
Is it possible to add all this in an access control rule, and if so, can you give me an example? I tested several options, and it seems that none of them work in the same way as the additional authentication rule.

Answer 1

This smells like an attempt to to by-pass on-premises MFA for Azure AD workload (such as Office 365). If so, bad idea. You'd better use Azure AD Conditional Access Policy to trigger MFA.

If that's not about that at all, let us know and we can dig into a technical solution.

Also, note that you can still use the "old" way to set Additional Authentication Rules in ADFS on Windows Server 2016. You will need to set the policy to null:

Set-AdfsRelyingPartyTrust -TargetName <Name of the Relaying Party Trust> -AccessControlPolicyName $null

And then modify the authorization rules from the ADFS console (when you set the policy to null and click on Edit Access Control Policy, it brings you the old Issuance Authorization Rules tab) and the additional authorization rules with PowerShell.