Update notice — September 2026: This article contains commands from the Azure AD and MSOnline PowerShell modules, kept as they were at original publication. Microsoft has deprecated these modules and recommends Microsoft Graph PowerShell for current automation. Do not use the legacy commands in new implementations.
Source: Migration guidance for Microsoft Graph: “Azure AD, Azure AD Preview and MSOnline PowerShell modules are deprecated.”
Hello, everyone. In today’s article, we’ll show how to integrate Microsoft Entra multifactor authentication with AD FS to allow users to use passcodes generated by Microsoft Authenticator when accessing an application.
In federated environments, Microsoft Entra multifactor authentication integrated with AD FS can be used to eliminate the use of passwords, whether configured as the primary authentication method or as the secondary authentication method, giving users a more secure way to access resources.
Requirements
To configure the integration of MFA with AD FS, the following requirements are necessary:
- An AD FS server federated with Microsoft Entra ID.
– Communication from the AD FS server to the URLs below on port 443:
https://adnotifications.windowsazure.com and https://login.microsoftonline.com. - Global Admin permission in the Microsoft Entra ID tenant you want to integrate.
- Enterprise Administrator permission on the AD FS servers.
Configuring the AD FS Servers
Let’s start by generating a certificate to be used by Microsoft Entra multifactor authentication on the AD FS server.
Open PowerShell in administrator mode and run the following command:
$certbase64 = New-AdfsAzureMfaTenantCertificate -TenantID 'entre com seu dominio no Azure'
The generated certificate can be found in the computer certificate store on the AD FS server.
Adding Credentials to the Microsoft Entra Multifactor Authentication Client Service
Let’s install the MSOnline module by running the following command:
Install-Module msonline
Let’s connect to the MSOnline service by running the following command:
Connect-MsolService
Enter credentials with Global Admin permission in the Azure domain and click Next.
After connecting to Microsoft Online Services, run the command below:
New-MsolServicePrincipalCredential -AppPrincipalId 981f26a1-7f43-403b-a875-f8b09b8cd720 -Type asymmetric -Usage verify -Value $certBase64
Configuring the AD FS Server
Now let’s configure the integration of the Microsoft Entra multifactor authentication client with AD FS. Run the command below on the AD FS server using PowerShell:
Set-AdfsAzureMfaTenant -TenantId-ClientId 981f26a1-7f43-403b-a875-f8b09b8cd720
Let’s restart the AD FS service so the settings take effect.
Restart-Service adfssrv
Enabling MFA on the AD FS Server
Now let’s enable MFA as an authentication method in AD FS. Open the AD FS management service and follow the steps below:
1 – Right-click the Authentication Methods option.
2 – Select Edit Primary Authentication Methods…
Let’s select Azure MFA for Extranet and Intranet.
Click Apply and Ok.
Accessing Services in Azure Using MFA on AD FS
When testing access to any Azure service that requires authentication via AD FS, we notice the Azure Multi-Factor Authentication option available.
By clicking Azure Multi-Factor Authentication, the user is prompted to fill in the fields below:
1 – Username
2 – Temporary verification code generated by the Microsoft Authenticator device.
3 – Click Sign in.
With the code verified, access was granted without the user needing to use a password, making access more secure.
Summary
In today’s article, we showed how to integrate Microsoft Entra multifactor authentication with AD FS to allow the use of codes generated by the Microsoft Authenticator app as an authentication method when users access an application.
I hope this content has contributed to enriching your knowledge of Microsoft Entra ID.
Did you like the post? Like and share it. 🙂
If you have any suggestions or comments, leave a comment.
[ ]’s
Ulysses Neves
