I'm the sole IT admin for a small org. I'm eager to improve our security with MFA by setting up AD FS, and for lots of reasons I was hoping to do that in the cloud. There is a helpful tutorial in Microsoft's docs (https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-azure-adfs). But that setup requires six VMs: two DCs, two WAPs, and two LBs.

Is all that really necessary? It would be pretty expensive for our org just to gain additional authentication security and flexibility. I know we would gain other things, too, like federated domain join and stuff, but I'm wondering if, in practice, there is a smaller-scale solution that provides reasonable reliability for a small org without extreme uptime demands.


You don't need an entire ADFS setup if you only want MFA, there is Azure MFA both in a Cloud Version and a MFA server for on-prem. The following link helps you decide what you need. https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-whichversion


If you only want MFA, then the path you should choose really depends on your environment.

  1. If you have on-prem AD You don't really need ADFS to authenticate in Office 365 using your on-prem AD credentials. Using password hash sync or pass-through auth will be enough. You would need at least one server for AD Connect though. You can find more information on authentication methods here: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-user-signin
  2. if you don't have on-prem AD You can simply join your Windows 10 machines to Azure AD.

Either option will allow you to use MFA

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.