This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(291.2, 28.000000000000004%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EH%3C/text%3E%3C/svg%3E)
Hello,
In this scenario, I have AD FS + Azure AD Connect (Synchronizing users to Azure AD). We have Exchange 2019 (On-premise) in our organization. I log in to the OWA portal through AD FS. I want to use Azure MFA for this OWA application (set in AD FS). I want to ask if users must have a license assigned in Azure AD? I only want to use the Authennticator app.
Thanks
@HanakJ ,
Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
Hello @HanakJ ,
Thanks for reaching out and apologies for the delayed response.
Azure MFA with ADFS can be used as Primary authentication as well as Secondary authentication and you must have Azure AD premium license assigned to use MFA for on-premises applications and here is feature comparison based on licenses for your reference. Hope this helps.
-----
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Hi @sikumars-msft,
so every user, who will use Authenticator app must have atleast Azure AD Premium P1.
@HanakJ ,
Yes, user must have atleast Azure AD premium P1 license to use Azure MFA for on-premises applications (Example: Exchange on-premises federated with ADFS).
-----
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Hello,
please I have another question. We want to MFA for Enterprise Application "Fortigate SSL VPN", for users sync to Azure AD. Only Authenticator App as a secondary auth. Do We need P1 or is it free?
Thanks
Yes, in this case Azure AD Free provides security defaults that provide Azure AD Multi-Factor Authentication, only the mobile authenticator app can be used for the authentication prompt, not a phone call or SMS. However, when you use security defaults to prompt users for multi-factor authentication as needed but you don't have granular control of enabled users or scenarios, but it does provide that additional security step.
Reference: https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing
-----
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.