If necessary, configure Conditional Access policies before you enable Staged Rollout.įor more information, see the following resources:

In this case, you'll need to analyze your claims rules on the Azure AD relying party trust and create Conditional Access policies that support the same security goals. If your federated domains have the federatedIdpMfaBehavior set to enforceMfaByFederatedIdp or SupportsMfa flag set to $True (the federatedIdpMfaBehavior overrides SupportsMfa when both are set), you're likely enforcing MFA on AD FS by using claims rules. They won’t be redirected to AD FS and MFA Server anymore. If you're already using Conditional Access to determine when users are prompted for MFA, you won’t need any changes to your policies.Īs users are migrated to cloud authentication, they'll start using Azure AD MFA as defined by your existing Conditional Access policies. Only use the security group to secure a group of high-value apps with a Conditional Access policy. We don't recommend that you reuse groups that are used for security. This process enables the iterative migration of users from MFA Server to Azure AD MFA based on group membership.Įach step is explained in the subsequent sections of this article. The following diagram shows the process for migrating to Azure AD MFA and cloud authentication while keeping some of your applications on AD FS. To select the appropriate MFA migration option for your organization, see the considerations in Migrate from MFA Server to Azure Active Directory MFA. See the move applications to Azure AD section of this article if you plan to move applications, covered in this article.

Best: Moving all of your applications, your MFA service, and user authentication to Azure AD.

Better: Moving your MFA service and user authentication to Azure AD, covered in this article.Good: Moving only your MFA service to Azure AD.There are several options for migrating from MFA Server to Azure Active Directory (Azure AD): Microsoft’s Multi-Factor Authentication Server (MFA Server) is no longer offered for new deployments.Ĭustomers who are using MFA Server should move to Azure AD Multi-Factor Authentication (Azure AD MFA). Multi-factor authentication (MFA) helps secure your infrastructure and assets from bad actors.

Microsoft azure mfa