|
Note: Perform the following steps on DC1
|
| bet | 6/8 | | Sana | 22.07.2021 | | Hajmi | 78.77 Kb. | | #15678 |
Note: Perform the following steps on DC1
Switch to the DC1 virtual machine
In the AD FS console, expand Trust Relationships in the left navigation pane, and click Relying Party Trusts
Right-click Microsoft Office 365 Identity Platform, and click Edit Claim Rules…
Click Add Rule…
Select Send Claims Using a Custom Rule from the Claim rule template menu, and click Next
Type Suppress AAD MFA in the Claim rule name field
Copy the following rule to the Custom rule field:
=> issue(Type = "http://schemas.microsoft.com/claims/authnmethodsreferences", Value = "http://schemas.microsoft.com/claims/multipleauthn");
Click Finish and click OK
Note: The addition of this claim rule allows AD FS to enforce MFA while leaving Azure Active Directory-integrated MFA enabled for users without subjecting them to multiple MFA challenges. You may be asking yourself, why wouldn’t we just disable Azure Active Directory-integrated MFA when using the Azure MFA Server with AD FS? The answer is the app password feature which is available in the Azure Active Directory-integrated version of the service. By layering in this capability on top of AD FS-integrated MFA, you can apply expressive policy to govern MFA for passive browser-based clients while still allowing rich clients like Outlook and Lync to connect to Office 365.
|
|
| |
