ADFS On Premise MFA (Azure) to Azure AD MFA

Question

I am trying to configure a phased approach to migrate Azure MFA Server to Azure AD MFA with Federation using the following document: https://learn.microsoft.com/en-us/azure/active-directory/authentication/how-to-migrate-mfa-server-to-azure-mfa-with-federation

In that document addresses claim rules one use to MFA a user externally through a specific provider depending on the group they are apart of. So far it seems no matter what I do I can do get MFA to work. The only condition that appears to rule is it determining whether I am internal or external. Any assistance with the Additional Authentication Rule and is there any prerequisites needed for ADFS to even consider those rules?

Set-AdfsRelyingPartyTrust -TargetName AppA -AdditionalAuthenticationRules 'c:[type ==
"https://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork", value == "false"] => issue(type =
"https://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod", value =
"https://schemas.microsoft.com/claims/multipleauthn" );
c:[Type == "https://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", Value ==
"YourGroupSID"] => issue(Type = "https://schemas.microsoft.com/claims/authnmethodsproviders",
Value = "AzureMfaAuthentication");
not exists([Type == "https://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
Value=="YourGroupSid"]) => issue(Type =
"https://schemas.microsoft.com/claims/authnmethodsproviders", Value =
"AzureMfaServerAuthentication");'

Answer 1

The first part is the MFA trigger:

c:[type ==  
"http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork", value == "false"] => issue(type =  
"http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod", value =  
"http://schemas.microsoft.com/claims/multipleauthn" );  

So MFA will be triggered only if the user is connected externally (and through a Web Application Proxy).

If you want enforce MFA regardless of the user location, you can do this instead:

Set-AdfsRelyingPartyTrust -TargetName AppA -AdditionalAuthenticationRules 'c:[] => issue(type =  
"http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod", value =  
"http://schemas.microsoft.com/claims/multipleauthn" );  
c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", Value ==  
"YourGroupSID"] => issue(Type = "http://schemas.microsoft.com/claims/authnmethodsproviders",  
Value = "AzureMfaAuthentication");  
not exists([Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",  
Value=="YourGroupSid"]) => issue(Type =  
"http://schemas.microsoft.com/claims/authnmethodsproviders", Value =  
"AzureMfaServerAuthentication");'