You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/authentication/howto-mfaserver-adfs-2.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
-
title: Use Azure MFA Server with AD FS 2.0
3
-
description: Describes how to get started with Azure MFA and AD FS 2.0.
2
+
title: Use Azure Active Directory Multi-Factor Authentication Server with AD FS 2.0
3
+
description: Describes how to get started with Azure Active Directory Multi-Factor Authentication and AD FS 2.0.
4
4
5
5
services: multi-factor-authentication
6
6
ms.service: active-directory
@@ -22,7 +22,7 @@ This article is for organizations that are federated with Azure Active Directory
22
22
This documentation covers using the Azure Multi-Factor Authentication Server with AD FS 2.0. For information about AD FS, see [Securing cloud and on-premises resources using Azure Multi-Factor Authentication Server with Windows Server](howto-mfaserver-adfs-windows-server.md).
23
23
24
24
> [!IMPORTANT]
25
-
> In September 2022, Microsoft announced deprecation of Azure Multi-Factor Authentication Server. Beginning September 30, 2024, Azure Multi-Factor Authentication Server deployments will no longer service multifactor authentication (MFA) requests, which could cause authentications to fail for your organization. To ensure uninterrupted authentication services and to remain in a supported state, organizations should [migrate their users’ authentication data](how-to-migrate-mfa-server-to-mfa-user-authentication.md) to the cloud-based Azure MFA service by using the latest Migration Utility included in the most recent [Azure MFA Server update](https://www.microsoft.com/download/details.aspx?id=55849). For more information, see [Azure MFA Server Migration](how-to-migrate-mfa-server-to-azure-mfa.md).
25
+
> In September 2022, Microsoft announced deprecation of Azure Multi-Factor Authentication Server. Beginning September 30, 2024, Azure Multi-Factor Authentication Server deployments will no longer service multifactor authentication (MFA) requests, which could cause authentications to fail for your organization. To ensure uninterrupted authentication services and to remain in a supported state, organizations should [migrate their users’ authentication data](how-to-migrate-mfa-server-to-mfa-user-authentication.md) to the cloud-based Azure Active Directory Multi-Factor Authentication service by using the latest Migration Utility included in the most recent [Azure Active Directory Multi-Factor Authentication Server update](https://www.microsoft.com/download/details.aspx?id=55849). For more information, see [Azure Active Directory Multi-Factor Authentication Server Migration](how-to-migrate-mfa-server-to-azure-mfa.md).
26
26
>
27
27
> To get started with cloud-based MFA, see [Tutorial: Secure user sign-in events with Azure Multi-Factor Authentication](tutorial-enable-azure-mfa.md).
This page covers a new installation of the server and setting it up with on-premises Active Directory. If you already have the MFA server installed and are looking to upgrade, see [Upgrade to the latest Azure Multi-Factor Authentication Server](howto-mfaserver-deploy-upgrade.md). If you're looking for information on installing just the web service, see [Deploying the Azure Multi-Factor Authentication Server Mobile App Web Service](howto-mfaserver-deploy-mobileapp.md).
25
25
26
26
> [!IMPORTANT]
27
-
> In September 2022, Microsoft announced deprecation of Azure Multi-Factor Authentication Server. Beginning September 30, 2024, Azure Multi-Factor Authentication Server deployments will no longer service multifactor authentication (MFA) requests, which could cause authentications to fail for your organization. To ensure uninterrupted authentication services and to remain in a supported state, organizations should [migrate their users’ authentication data](how-to-migrate-mfa-server-to-mfa-user-authentication.md) to the cloud-based Azure MFA service by using the latest Migration Utility included in the most recent [Azure MFA Server update](https://www.microsoft.com/download/details.aspx?id=55849). For more information, see [Azure MFA Server Migration](how-to-migrate-mfa-server-to-azure-mfa.md).
27
+
> In September 2022, Microsoft announced deprecation of Azure Multi-Factor Authentication Server. Beginning September 30, 2024, Azure Multi-Factor Authentication Server deployments will no longer service multifactor authentication (MFA) requests, which could cause authentications to fail for your organization. To ensure uninterrupted authentication services and to remain in a supported state, organizations should [migrate their users’ authentication data](how-to-migrate-mfa-server-to-mfa-user-authentication.md) to the cloud-based Azure Active Directory Multi-Factor Authentication service by using the latest Migration Utility included in the most recent [Azure Active Directory Multi-Factor Authentication Server update](https://www.microsoft.com/download/details.aspx?id=55849). For more information, see [Azure Active Directory Multi-Factor Authentication Server Migration](how-to-migrate-mfa-server-to-azure-mfa.md).
28
28
29
29
> To get started with cloud-based MFA, see [Tutorial: Secure user sign-in events with Azure Multi-Factor Authentication](tutorial-enable-azure-mfa.md).
30
30
@@ -42,9 +42,9 @@ A good guideline for the amount of memory you need is the number of users you ex
42
42
| 100,000-200,001 | 16 GB |
43
43
| 200,001+ | 32 GB |
44
44
45
-
Do you need to set up multiple servers for high availability or load balancing? There are many ways to set up this configuration with Azure MFA Server. When you install your first Azure MFA Server, it becomes the master. Any other servers become subordinate, and automatically synchronize users and configuration with the master. Then, you can configure one primary server and have the rest act as backup, or you can set up load balancing among all the servers.
45
+
Do you need to set up multiple servers for high availability or load balancing? There are many ways to set up this configuration with Azure Active Directory Multi-Factor Authentication Server. When you install your first Azure Active Directory Multi-Factor Authentication Server, it becomes the master. Any other servers become subordinate, and automatically synchronize users and configuration with the master. Then, you can configure one primary server and have the rest act as backup, or you can set up load balancing among all the servers.
46
46
47
-
When a master Azure MFA Server goes offline, the subordinate servers can still process two-step verification requests. However, you can't add new users and existing users can't update their settings until the master is back online or a subordinate gets promoted.
47
+
When a master Azure Active Directory Multi-Factor Authentication Server goes offline, the subordinate servers can still process two-step verification requests. However, you can't add new users and existing users can't update their settings until the master is back online or a subordinate gets promoted.
48
48
49
49
### Prepare your environment
50
50
@@ -56,17 +56,17 @@ Make sure the server that you're using for Azure Multi-Factor Authentication mee
56
56
| Software |<li>Windows Server 2022<sup>1</sup><li>Windows Server 2019<sup>1</sup></li><li>Windows Server 2016</li><li>Windows Server 2012 R2</li><li>Windows Server 2012</li><li>Windows Server 2008/R2 (with [ESU](/lifecycle/faq/extended-security-updates) only)</li><li>Windows 10</li><li>Windows 8.1, all editions</li><li>Windows 8, all editions</li><li>Windows 7, all editions (with [ESU](/lifecycle/faq/extended-security-updates) only)</li><li>Microsoft .NET 4.0 Framework</li><li>IIS 7.0 or greater if installing the user portal or web service SDK</li> |
57
57
| Permissions | Domain Administrator or Enterprise Administrator account to register with Active Directory |
58
58
59
-
<sup>1</sup>If Azure MFA Server fails to activate on an Azure VM that runs Windows Server 2019 or later, try using an earlier version of Windows Server.
59
+
<sup>1</sup>If Azure Active Directory Multi-Factor Authentication Server fails to activate on an Azure VM that runs Windows Server 2019 or later, try using an earlier version of Windows Server.
60
60
61
-
### Azure MFA Server Components
61
+
### Azure Active Directory Multi-Factor Authentication Server Components
62
62
63
-
There are three web components that make up Azure MFA Server:
63
+
There are three web components that make up Azure Active Directory Multi-Factor Authentication Server:
64
64
65
-
* Web Service SDK - Enables communication with the other components and is installed on the Azure MFA application server
65
+
* Web Service SDK - Enables communication with the other components and is installed on the Azure Active Directory Multi-Factor Authentication application server
66
66
* User portal - An IIS web site that allows users to enroll in Azure Multi-Factor Authentication (MFA) and maintain their accounts.
67
67
* Mobile App Web Service - Enables using a mobile app like the Microsoft Authenticator app for two-step verification.
68
68
69
-
All three components can be installed on the same server if the server is internet-facing. If breaking up the components, the Web Service SDK is installed on the Azure MFA application server and the User portal and Mobile App Web Service are installed on an internet-facing server.
69
+
All three components can be installed on the same server if the server is internet-facing. If breaking up the components, the Web Service SDK is installed on the Azure Active Directory Multi-Factor Authentication application server and the User portal and Mobile App Web Service are installed on an internet-facing server.
70
70
71
71
### Azure Multi-Factor Authentication Server firewall requirements
72
72
@@ -108,20 +108,20 @@ If you aren't using the Event Confirmation feature, and your users aren't using
Follow these steps to download the Azure AD Multi-Factor Authentication Server from the Azure portal:
111
+
Follow these steps to download the Azure AD Multi-Factor Authentication Server:
112
112
113
113
> [!IMPORTANT]
114
-
> In September 2022, Microsoft announced deprecation of Azure Multi-Factor Authentication Server. Beginning September 30, 2024, Azure Multi-Factor Authentication Server deployments will no longer service multifactor authentication (MFA) requests, which could cause authentications to fail for your organization. To ensure uninterrupted authentication services and to remain in a supported state, organizations should [migrate their users’ authentication data](how-to-migrate-mfa-server-to-mfa-user-authentication.md) to the cloud-based Azure MFA service by using the latest Migration Utility included in the most recent [Azure MFA Server update](https://www.microsoft.com/download/details.aspx?id=55849). For more information, see [Azure MFA Server Migration](how-to-migrate-mfa-server-to-azure-mfa.md).
114
+
> In September 2022, Microsoft announced deprecation of Azure Multi-Factor Authentication Server. Beginning September 30, 2024, Azure Multi-Factor Authentication Server deployments will no longer service multifactor authentication (MFA) requests, which could cause authentications to fail for your organization. To ensure uninterrupted authentication services and to remain in a supported state, organizations should [migrate their users’ authentication data](how-to-migrate-mfa-server-to-mfa-user-authentication.md) to the cloud-based Azure Active Directory Multi-Factor Authentication service by using the latest Migration Utility included in the most recent [Azure Active Directory Multi-Factor Authentication Server update](https://www.microsoft.com/download/details.aspx?id=55849). For more information, see [Azure Active Directory Multi-Factor Authentication Server Migration](how-to-migrate-mfa-server-to-azure-mfa.md).
115
115
>
116
116
> To get started with cloud-based MFA, see [Tutorial: Secure user sign-in events with Azure Multi-Factor Authentication](tutorial-enable-azure-mfa.md).
117
117
>
118
118
> Existing customers that activated MFA Server before July 1, 2019 can download the latest version, future updates, and generate activation credentials as usual. The following steps only work if you were an existing MFA Server customer.
119
119
120
-
11. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Administrator](../roles/permissions-reference.md#global-administrator).
120
+
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Administrator](../roles/permissions-reference.md#global-administrator).
121
121
1. Browse to **Protection** > **Multifactor authentication** > **Server settings**.
122
122
4. Select **Download** and follow the instructions on the download page to save the installer.
123
123
124
-

5. Keep this page open as we will refer to it after running the installer.
127
127
@@ -135,7 +135,7 @@ Now that you have downloaded the server you can install and configure it. Be sur
135
135
*[Visual C++ Redistributable for Visual Studio 2017 (x64)](https://go.microsoft.com/fwlink/?LinkId=746572)
136
136
*[Visual C++ Redistributable for Visual Studio 2017 (x86)](https://go.microsoft.com/fwlink/?LinkId=746571)
137
137
3. When the installation finishes, select **Finish**. The configuration wizard starts.
138
-
5. Back on the page that you downloaded the server from, click the **Generate Activation Credentials** button. Copy this information into the Azure MFA Server in the boxes provided and click **Activate**.
138
+
5. Back on the page that you downloaded the server from, click the **Generate Activation Credentials** button. Copy this information into the Azure Active Directory Multi-Factor Authentication Server in the boxes provided and click **Activate**.
139
139
140
140
> [!NOTE]
141
141
> Only global administrators are able to generate activation credentials in the Microsoft Entra admin center.
@@ -164,7 +164,7 @@ Now that the server is installed you want to add users. You can choose to create
164
164
165
165
### Manual import from Active Directory
166
166
167
-
1. In the Azure MFA Server, on the left, select **Users**.
167
+
1. In the Azure Active Directory Multi-Factor Authentication Server, on the left, select **Users**.
168
168
2. At the bottom, select **Import from Active Directory**.
169
169
3. Now you can either search for individual users or search the AD directory for OUs with users in them. In this case, we specify the users OU.
170
170
4. Highlight all the users on the right and click **Import**. You should receive a pop-up telling you that you were successful. Close the import window.
@@ -173,15 +173,15 @@ Now that the server is installed you want to add users. You can choose to create
173
173
174
174
### Automated synchronization with Active Directory
175
175
176
-
1. In the Azure MFA Server, on the left, select **Directory Integration**.
176
+
1. In the Azure Active Directory Multi-Factor Authentication Server, on the left, select **Directory Integration**.
177
177
2. Navigate to the **Synchronization** tab.
178
178
3. At the bottom, choose **Add**
179
179
4. In the **Add Synchronization Item** box that appears choose the Domain, OU **or** security group, Settings, Method Defaults, and Language Defaults for this synchronization task and click **Add**.
180
180
5. Check the box labeled **Enable synchronization with Active Directory** and choose a **Synchronization interval** between one minute and 24 hours.
181
181
182
182
## How the Azure AD Multi-Factor Authentication Server handles user data
183
183
184
-
When you use the Multi-Factor Authentication (MFA) Server on-premises, a user's data is stored in the on-premises servers. No persistent user data is stored in the cloud. When the user performs a two-step verification, the MFA Server sends data to the Azure MFA cloud service to perform the verification. When these authentication requests are sent to the cloud service, the following fields are sent in the request and logs so that they are available in the customer's authentication/usage reports. Some of the fields are optional so they can be enabled or disabled within the Multi-Factor Authentication Server. The communication from the MFA Server to the MFA cloud service uses SSL/TLS over port 443 outbound. These fields are:
184
+
When you use the Multi-Factor Authentication (MFA) Server on-premises, a user's data is stored in the on-premises servers. No persistent user data is stored in the cloud. When the user performs a two-step verification, the MFA Server sends data to the Azure Active Directory Multi-Factor Authentication cloud service to perform the verification. When these authentication requests are sent to the cloud service, the following fields are sent in the request and logs so that they are available in the customer's authentication/usage reports. Some of the fields are optional so they can be enabled or disabled within the Multi-Factor Authentication Server. The communication from the MFA Server to the MFA cloud service uses SSL/TLS over port 443 outbound. These fields are:
185
185
186
186
* Unique ID - either username or internal MFA server ID
187
187
* First and last name (optional)
@@ -199,16 +199,16 @@ In addition to the fields above, the verification result (success/denial) and re
199
199
> [!IMPORTANT]
200
200
> Starting in March of 2019 the phone call options will not be available to MFA Server users in free/trial Azure AD tenants. SMS messages are not impacted by this change. Phone call will continue to be available to users in paid Azure AD tenants. This change only impacts free/trial Azure AD tenants.
201
201
202
-
## Back up and restore Azure MFA Server
202
+
## Back up and restore Azure Active Directory Multi-Factor Authentication Server
203
203
204
204
Making sure that you have a good backup is an important step to take with any system.
205
205
206
-
To back up Azure MFA Server, ensure that you have a copy of the **C:\Program Files\Multi-Factor Authentication Server\Data** folder including the **PhoneFactor.pfdata** file.
206
+
To back up Azure Active Directory Multi-Factor Authentication Server, ensure that you have a copy of the **C:\Program Files\Multi-Factor Authentication Server\Data** folder including the **PhoneFactor.pfdata** file.
207
207
208
208
In case a restore is needed complete the following steps:
209
209
210
-
1. Reinstall Azure MFA Server on a new server.
211
-
2. Activate the new Azure MFA Server.
210
+
1. Reinstall Azure Active Directory Multi-Factor Authentication Server on a new server.
211
+
2. Activate the new Azure Active Directory Multi-Factor Authentication Server.
212
212
3. Stop the **MultiFactorAuth** service.
213
213
4. Overwrite the **PhoneFactor.pfdata** with the backed-up copy.
214
214
5. Start the **MultiFactorAuth** service.
@@ -222,7 +222,7 @@ Once you have upgraded to or installed MFA Server version 8.x or higher, it is r
222
222
## Next steps
223
223
224
224
- Set up and configure the [User portal](howto-mfaserver-deploy-userportal.md) for user self-service.
225
-
- Set up and configure the Azure MFA Server with [Active Directory Federation Service](multi-factor-authentication-get-started-adfs.md), [RADIUS Authentication](howto-mfaserver-dir-radius.md), or [LDAP Authentication](howto-mfaserver-dir-ldap.md).
225
+
- Set up and configure the Azure Active Directory Multi-Factor Authentication Server with [Active Directory Federation Service](multi-factor-authentication-get-started-adfs.md), [RADIUS Authentication](howto-mfaserver-dir-radius.md), or [LDAP Authentication](howto-mfaserver-dir-ldap.md).
226
226
- Set up and configure [Remote Desktop Gateway and Azure Multi-Factor Authentication Server using RADIUS](howto-mfaserver-nps-rdg.md).
227
227
-[Deploy the Azure Multi-Factor Authentication Server Mobile App Web Service](howto-mfaserver-deploy-mobileapp.md).
228
228
-[Advanced scenarios with Azure Multi-Factor Authentication and third-party VPNs](howto-mfaserver-nps-vpn.md).
0 commit comments