Azure MFA Service on ADFS 2019 - Custom AD field sent back to Azure

Question

I have configured our ADFS servers to utilize Azure MFA Service Authentication Module as an Additional Authentication Provider. We are looking to MFA enable additional in-house web apps.

https://dirteam.com/sander/2019/12/12/howto-enable-azure-multi-factor-authentication-on-ad-fs/

This works great and as expected IF your local user account's UPN matches their account's UPN in our Azure tenant. Unfortunately, we have a non-routable internal domain name and cannot use a UPN suffix to correct due to another LOB application the organization uses. We have modified our AD Connect sync rules to create tenant account's using their mail attribute while we move toward a domain name change project (could take awhile). Until then, we've made concessions and workarounds. An example being the NPS Extension that allows us to use MFA for our RDS environment. That extension has local registry entries that allow us to customize what local user's AD field gets sent as the user's name back to Azure and their Azure MFA works great.

I am unable to find similar configurations for the ADFS authentication method. I am hoping this is simply due to a lack of knowledge versus a direct inability to configure.

Answer 1

I am not aware of a registry trick for the provider. However, it should work with alternate logon ID. I am not sure if the provider works with non routable UPN as I never got to try that. But it is worth a try. https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configuring-alternate-login-id

Answer 2

Thank you, I have plans on that anyway to make transitions easier as we do migrate our logins; however, I have not yet put that in place. I'll work on that and post back one way or another.

Answer 3

Configuring Alternate ID on the ADFS server proved successful. Users can now login using either their email address or Domain Name format. When using their email address and when Access Control Policies require MFA, the email address is sent to Azure as the user name which properly finds the account and prompt's the user's authenticator device.