0

There are big question marks above my head regarding SharePoint 2019 and Azure MFA...

We're running a three tier SharePoint Single Server Farm, each with a High Trust Provider Hosted App. After that's finished and everything runs smoothly the Multi-Factor-Authentication should come on top. But unfortunately I can't find (maybe I searched the wrong way) any usable informations to do so. Here and there are some forum topics which aren't clear enough for me (like this: https://social.msdn.microsoft.com/Forums/en-US/0dde4b1b-c144-44c6-a169-ef88d5cc9aff/mfa-for-sharepoint-server-2019-in-azure-vms?forum=WindowsAzureAD).

Maybe some of you have some other sources where to look and how to get MFA working with SharePoint 2019 hosted on Azure VMs.

1

You can either use the Azure AD integration (I don't recommend this due to needing to configure SAML on SharePoint) or use Azure AD App Proxy which will let you use Kerberos Constrained Delegation, but requires you to deploy additional VMs to support the farm. For the Azure AD App Proxy tutorial with SharePoint, you do not need to use a different name for the internal and external URLs, their tutorial just shows that path.

With either solution, you will use the standard Microsoft Online login screen where your MFA policy is enforced. You can also add Conditional Access Policies, if required.

  • Why wouldn't you recommend SAML on SharePoint against the configuration with Kerberos? I think the Azure AD App Proxy would mean that we have to re-do our currently environments. Web Applications has been created with Host Names, there is no internal/external URL. There's only that one like sp.domain.com and app.domain.com for the PHA. – airliner Mar 20 at 6:59
  • 1
    SAML has significant UX issues in SharePoint Server, unfortunately. As for App Proxy, you can use the same URL internally and externally -- I'm not a huge fan of the examples provided on the site (if you scroll to the very bottom of that page you can see my closed feedback).. – Trevor Seward Mar 20 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.