You do so by configuring claims rules, also known as relying party trusts.

Now that Azure AD MFA is an additional authentication method, you can assign groups of users to use it. Configure claims rules to invoke Azure AD MFA The article covers both upgrading your farm to AD FS 2019 and upgrading your FBL to 4. For more information, see Upgrading to AD FS in Windows Server 2016 using a WID database. By specifying an additional authentication method, you can transition to Azure AD MFA while keeping other authentication intact during the transition. You use group membership to determine authentication provider. In AD FS 2019, you can specify additional authentication methods for a relying party, such as an application. Prepare AD FS Upgrade AD FS server farm to 2019, FBL 4 If you're using a security group to secure a group of high-value apps with a Conditional Access policy, only use the group for that purpose. These groups are used in your claims rules.ĭon't reuse groups that are used for security. You'll also need an Azure AD security group for iteratively migrating users to Azure AD MFA. You can use existing Azure AD security groups or Microsoft 365 Groups for this purpose. To create new conditional access policies, you'll need to assign those policies to groups. The following diagram shows the process of this migration. The Azure AD relying party trust and other relying party trusts are configured to use Azure AD MFA for migrated users. To migrate to Azure AD MFA with federation, the Azure AD MFA authentication provider is installed on AD FS. For more information, see the process for migrating to Azure AD MFA with cloud authentication.

Consider also moving to Azure AD for user authentication in the future. Moving your multi-factor-authentication (MFA) solution to Azure Active Directory (Azure AD) is a great first step in your journey to the cloud.

Adfs azure mfa