MFA Certificate and adjust the validity period as required (3 years for me)ħ. On the General Tab give the template a distinguishable name i.e. Change the CA type to your oldest CA server OS. Select the USER certificate template and select duplicate templateĥ. Open your certificate authority and manage certificate templates. In the same Group Policy enable Certificate Services Client – Certificate Enrollment PolicyĮnable this and Active Directory settings should be automatically populatedĤ. Next create and link a Group Policy to your Users OU called MFA-Cert_EnrolĮdit the Group Policy and make the following changes User Configuration/Policies/Security Settings/Public Key PoliciesĮnable Certificate Client Services – Auto Enrollmentģ. This is the group that users need to be a member of to auto enroll for user certificates. Create a Security Group in Active Directory call it what you like. Once you have these pre-requisites in place you can start to configure MFAġ. Port TCP 49443 open inbound to your WAP server VIP.Web publishing point for your CA revocation lists.In order to set this up you need the following installed and in production: However, the customer liked the idea of the relatively simple management and roll out that certificate based MFA provides. I am pretty sure that the design could have been achieved using Azure MFA and a few claim rules in ADFS. In addition these users must perform multi-factor authentication when outside the corporate LAN only. The design brief stated that only domain joined devices from outside the corporate LAN can consume Office 365 services. There were a few niggles along the way but on the whole it was a relatively easy process to complete.

I had to implement MFA using ADFS 3.0 and internally signed certificates in order to authenticate external users against Office 365 services.

Adfs azure mfa