AD FS Policies
ESA installer sets the following AD FS authentication rules:
c:[Type == "http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork", Value == "false"] => issue(Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod", Value = "http://schemas.microsoft.com/claims/multipleauthn"); |
c:[Type == "http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork", Value == "true"] => issue(Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod", Value = "http://schemas.microsoft.com/claims/multipleauthn"); |
The rules above automatically enable two-factor authentication (2FA) for both internal and external networks.
If you use a third-party AD FS app that does not work properly with 2FA, and you want to exclude specific users from using 2FA to access that app, then you must edit the AD FS policy.
1.Open Windows PowerShell and execute the following command. Then check the output of that command to verify that the only additional authentication rules are the ones listed at the beginning of this section.
Get-AdfsAdditionalAuthenticationRule |
2.To remove additional authentication rules, execute the following command:
Set-AdfsAdditionalAuthenticationRule -AdditionalAuthenticationRules ' ' |
3.Open AD FS Management, click Access Control Policies > Action > Add Access Control Policy.
4. Add the following two Permit Users rules:
I.Permit Users II.Permit Users |
Create an esac.eset.com\ESA Users group and assign ESA users to the group.
The two Permit Users rules above will ensure, that 2FA is required only for users belonging to the specified group. For all other users the 2FA authentication page is skipped.
5.Click Relying Party Trusts, assign the policy to the applicable relying party.