ADFS 2019 allow sign in from specific IP for specific users

Stijn 26 Reputation points
2020-10-13T13:26:37.967+00:00

Hi,

We have an ADFS 2019 and ADFS 2019 Proxy servers to have SSO with Office 365.
For a specific group in our AD we only want to allow the signin from a specific IP or a computer that is joined in our domain.
All other users can sign in from everywhere.
When I search on internet I can only find documentation about ADFS 2012 and I need to create Issuance Authorization Rules.
But in ADFS 2019 I don't have Issuance Authorization Rules.
How can I achieve my goal?

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,203 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vasil Michev 96,161 Reputation points MVP
    2020-10-13T14:42:08.52+00:00

    Of course you do, they're simply packaged as Access Control Policies: https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/access-control-policies-in-ad-fs

  2. Pierre Audonnet - MSFT 10,166 Reputation points Microsoft Employee
    2020-10-15T00:22:55.93+00:00

    Like @Vasil Michev says you can use Access Control Policies.

    Let say you want to allow all users but if the user is a member of the group TESTG then you allow the connection only if the IP is 1.2.3.4. You will have the following policy:

    32455-image.png

    The first part allow all users as long as they are not member of the group.
    If they are member of the group then we allow them as long as the IP is not between 0.0.0.0 and 1.2.3.3 and not between 1.2.3.6 and 255.255.255.255. In other word we allow only if the if IP is 1.2.3.4.

    Also, you can still use the "old school" issuance authorization rules in Windows Server 2019 ADFS. To do so, set the policy of your relying party to $null, example: 

    Set-AdfsRelyingPartyTrust -TargetName ClaimsXray -AccessControlPolicyName:$null

    Then check the GUI and you'll see your policy has been converted into an old school one :)

    32390-image.png

    0 comments