For detailed guidance, see Customize the AD FS web page to guide users to register MFA verification methods in this article. You can do this using onload.js customization to detect the error message string within the AD FS page and show a new message to direct the user to to reattempt authentication. As an AD FS administrator, you can customize this error experience to guide the user to the proofup page instead. When a user that hasn't yet proofed up in Azure AD tries to authenticate with Azure AD Multi-Factor Authentication at AD FS, you get an AD FS error. Without support for inline proof, users must get proofed up by visiting prior to using Azure AD Multi-Factor Authentication to authenticate to AD FS applications. Registering users for Azure AD Multi-Factor Authentication using AD FSĪD FS doesn't support inline 'proofup' (registration of Azure AD Multi-Factor Authentication security verification information such as phone number or mobile app). The Azure AD Multi-Factor Authentication adapter is built in to Windows Server 2016.

Unlike with AD FS in Windows Server 2012 R2, the AD FS 2016 Azure AD Multi-Factor Authentication adapter integrates directly with Azure AD and doesn't require an on premises Azure AD Multi-Factor Authentication server. With AD FS, you can configure Azure AD Multi-Factor Authentication for primary authentication or use it as an additional authentication provider. Azure AD Multi-Factor Authentication enables you to eliminate passwords and provide a more secure way to authenticate. If your organization is federated with Azure AD, you can use Azure AD Multi-Factor Authentication to secure AD FS resources, both on-premises and in the cloud.

Adfs azure mfa