The good news is there is a fairly simple way to make this happen, and we get to use PowerShell to do it! First step is to define a few things: So if I configured my ADFS to require MFA for all domain users, how might I exclude a set of users from this requirement? What we don't have via the GUI is an easy way to _exclude_ a user or group of users from the requirement of MFA. When looking at the ADFS 3.0 MFA configuration GUI there is a simple way to add users and groups to enforce the use of Multi Factor Authentication for specific users/groups. I had a need to configure an environment where everyone was required to use multi-factor authentication _except_ for folks in a specific AD group. Hi there, JJ Streicher-Bremer back again, this time talking about ADFS and multi-factor authentication. Hit the “Sign in to this site” radio button and then click Sign in.First published on TechNet on Jul 26, 2016 You’ll also probably want to disable Windows Authentication (IWA aka Integrated Windows Authentication) on the Intranet in AD FS if this a test environment just so you don’t get auto-logged in. Now on my Windows 10 desktop, I am going to navigate to the IdP initiated AD FS login URL to test this.
The AD FS with Azure MFA as Primary Authentication user experienceġ5. I’m just going to select both in this example since I will be testing logins from an internal Windows 10 desktop in the next few steps and I want to see the Azure MFA option show up:
Most companies I work with choose to only enable it for their Extranet, meaning users that come in through the AD FS WAP (Web Application Proxy) servers in the DMZ. Go ahead and check the box next to them so you can choose when the Azure MFA option is shown to users.
0 kommentar(er)
