Introduction
In the previous article, we configured Single Sign-On between on-premises AD and Cloud Identity or Google Workspace using ADFS and SAML Federation. However, I haven’t enabled multifactor authentication to secure ADFS resources.
In this article, I will demonstrate you how to secure ADFS resources, including the Google Workspace application, using Microsoft Entra Multifactor Authentication. By the end of this article, you will have a clear understanding of how to enhance the security of your ADFS resources and safeguard them from potential threats. So, let’s dive in and explore together!
Benefits
- Implementing this security solution (Entra MFA) protects your organisation accounts and ADFS resources, including Google Workspace applications.
- Entra MFA puts an extra barrier (much harder for unauthorised individuals) between your business and cybercriminals who try to steal usernames and passwords to access business data and sensitive information.
- Entra MFA enforces employees to provide two or more forms of identity verification before accessing an account.
- Entra MFA enables organisation to eliminate passwords and provide a more secure way to authenticate.
- Entra MFA increase security, reduced the risk of data breaches, and improve regulatory compliance.
- Entra MFA can provide peace of mind, knowing that your accounts are better protected from cyber-attacks.
- Entra MFA helps organisations safeguard resources and maintain their reputation as secure and reliable business partners.
Before you Begin
- The organisation must configure Microsoft Entra MFA on their ADFS farm.
- Starting from ADFS 2016, the Microsoft Entra MFA adapter seamlessly integrates with Microsoft Entra ID.
- It is not necessary to install an MFA solution in on-premises environments.
- The organisation must synchronise their on-premises accounts with Microsoft Entra Tenant.
- “Microsoft Entra ID Free” subscription is enough to get the Entra MFA feature.
- UPN domain suffix must be federated with Microsoft Entra ID.
- Global administrator ( Entra ID) and on-premise Enterprise Admin credentials are required to configure the set-up.
- Microsoft Graph PowerShell is required.
- At the firewall end, open port 443 for the below URL from ADFS Farm.
- https://adnotifications.windowsazure.com
https://login.microsoftonline.com
- ADFS doesn’t allow users to enrol or register Entra MFA automatically.
- Employees must register or Enrol Entra MFA before using the Entra MFA to authenticate to ADFS resources.
You can use Microsoft Entra MFA either as a primary authentication provider or as an additional authentication provider based on your business needs.
| This demonstration focus on configuring Entra MFA as an additional authentication method for only Google Workspace applications. You can create relying party trust to use Entra MFA for Microsoft 365 applications and other application such as ServiceNow, Confluence, WordPress, etc |
Implementation Steps
Step 1: Generate a Certificate for Microsoft Entra MFA
To get started, run the following PowerShell cmdlet on your primary ADFS server to generate the new certificate.
$certbase64 = New-AdfsAzureMfaTenantCertificate -TenantID “Tenant Name NOT Tenant ID“
Tenant ID = Your Microsoft Entra ID Tenant Name. [Example : M365DS260448.onmicrosoft.com]
After running the command, you can see the certificate is stored in the local machine certificate store.
Once completed, follow the steps to generate the certification for all servers in your ADFS farm.
Step 2: Set the Certificate as the New Credential against the Entra MFA Client
To enable the AD FS servers to communicate with the Entra MFA Client, you must add the credentials to the Service Principal for the Entra MFA Client.
There is no need to create a service principle; it is already available by default. All we must do is add the credential to it.
To do that, open the PowerShell from the Administrator privilege->connect to Microsoft Graph-> Run the following script provided by Microsoft.
The certificate created in Step 1 will serve as the credentials for the Entra MFA Client.
Note: Run the command for all the servers in the ADFS farm.
| Connect-MgGraph -Scopes ‘Application.ReadWrite.All’ $servicePrincipalId = (Get-MgServicePrincipal -Filter “appid eq ‘981f26a1-7f43-403b-a875-f8b09b8cd720′”).Id $keyCredentials = (Get-MgServicePrincipal -Filter “appid eq ‘981f26a1-7f43-403b-a875-f8b09b8cd720′”).KeyCredentials $certX509 = System.Security.Cryptography.X509Certificates.X509Certificate2 $newKey = @(@{ CustomKeyIdentifier = $null DisplayName = $certX509.Subject EndDateTime = $null Key = $certX509.GetRawCertData() KeyId = [guid]::NewGuid() StartDateTime = $null Type = “AsymmetricX509Cert” Usage = “Verify” AdditionalProperties = $null }) $keyCredentials += $newKey Update-MgServicePrincipal -ServicePrincipalId $servicePrincipalId -KeyCredentials $keyCredentials |
You can find the appid by running the below command.
(Get-MgServicePrincipal -Filter “appid eq ‘981f26a1-7f43-403b-a875-f8b09b8cd720′”)
Step 3: Register the Entra Tenant Information
After completing the steps in the previous section for each AD FS server, register your Entra Tenant information. This command should only be executed once for an AD FS farm.
Please restart the ADFS service as per the recommendation shown in the output.
Please DO NOT enter the Tenant ID. Enter only the Tenant Name you received when registering your Microsoft 365 tenant.
Step 4: Verify the Entra MFA Registration
Microsoft Entra MFA is now the primary authentication method for both intranet and extranet use after the service restarts.
Step 5: Enable Entra MFA as an additional authentication to Google Workspace Application
To enable Entra MFA authentication method in ADFS server, Open the ADFS management Console, Navigate to ADFS->Authentication Methods->Edit Multi-factor Authentication Methods…–>Enable Azure MFA.
Our journey in configuring Entra Multifactor authentication for ADFS resources has been fruitful. Now, it’s time to enforce Google Workspace applications to use Microsoft Entra MFA. To do this, we need to modify the Access Control Policy of the Relying Party Trust that we’ve previously created for Google Application.
Just, Right Click the Relying Party trust , that is Google->Edit Access Control Policy->Permit Everyone and require MFA.
Step 6: User Experience
Now that we’ve successfully configured ADFS with Microsoft Entra MFA, it’s important to verify if Entra MFA is functioning as intended. To do this, follow the test outlined below:
Step 6.1: User who already proofed up in Microsoft Entra ID
- Choose an Active Directory user previously provisioned to Cloud Identity or Google Workspace and registered with Entra MFA.
- Open a new browser window and go to https://mail.google.com/
- Enter the user’s email address on the Google Sign-In page and click Next. If you use domain substitution, you must apply the substitution to the email address.
- You are redirected to AD FS. You now see the sign-in page if you configured AD FS to use forms-based authentication.
- Enter your UPN and password for the Active Directory user, and click Sign in.
- Open the Microsoft Authenticator page and tap the number displayed to approve the sign-in
- Now you are redirected to the Gmail mailbox
- At the upper left, click the avatar icon and click Sign out. You will then be redirected to an AD FS page confirming that you’ve been successfully signed out
Watch the video, demonstrating the user experience while accessing Gmail. This user has already registered and validated his identity in Entra ID, means his or her user account already registered for Microsoft Entra Multifactor Authentication.
Step 6.2: User who hasn’t proofed up in Microsoft Entra ID
Watch the video to understand exactly what occurs when someone who hasn’t verified their identity with Entra ID tries to access the Google Workspace application.
Thank you for reading this article and for your invaluable support. We greatly appreciate your engagement.
If you would like to obtain more information regarding this feature, please refer to the Microsoft document.
Recent Comments