Hi We use ADFS 3.0 for O365 and some 3rd party web / apps. Now we're implementing a new website. My original idea was to just add it to our ADFS but now the project has decided that it need 2FA. In the future I see all our apps authenticate in Azure AD but I can't move them right now. There fore I'd prefer to keep current apps in ADFS but add the new app to Azure AD with PTA and MFA. Can I some how use Azure AD for authentication on my new app and still authenticate O365 in ADFS? //Johan
@JFH-2484 Yes, you can do that. If you have O365 federated with ADFS and you federate an application with Azure AD, the authentication flow would be:
User accesses the application which is federated to Azure AD.
Application will redirect to Azure AD authentication endpoint (https://login.microsoftonline.com) for authentication.
User will be prompted for credentials.
Based on the UPN suffix (If the domain is federated with ADFS), user will be redirected to ADFS.
ADFS will authenticate the user and issue a WS-Fed token to Azure AD.
Azure AD will receive the token and issue a SAML token to the application.
User will finally get access to application.
Please "accept as answer" or "vote as helpful" wherever the information provided helps you to help others in the community.
Thank you Amanpreetsingh for your answer.
So you are saying that because UPN is a federated domain, authentication must happen on the onprem ADFS?
I was hoping for some way to "tell" Azure AD authentication endpoint that it should handle the athentication in Azure and not redirect to onprem ADFS.
Otherwise I guess I need MFA in ADFS?
Yes, you would need MFA in ADFS. You can configure Azure MFA with ADFS 2016 or later. Refer to https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-and-azure-mfa for more details.
Both federation and PTA are domain-wide features, so they generally apply to all users. There's however a preview of the so-called "staged rollout" feature, which allows you to switch just some users from federation to other auth types. Read here: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-staged-rollout
6 people are following this question.
