How to exclude certain users from MFA in ADFS 3.0

Although we do not recommend exclude any users from 2FA, but some organizations have their justifications for excluding certain users from MFA. In ADFS 3.0 (Win Server 2012 R2) doesn't have GUI to apply such policy and you need to amend on claims rule by power-shell, but it's available in Win server 2016 and later as GUI.

Let assume that you applied MFA by adding group "domain users" in the edit authentication policy. You need to exclude specific users from MFA, create another security group then add required users, then apply the below custom rule :

1 :

 Get the SID of domain users "S-1-5-21domain-513" and EX_MFA group.

2 :

$MFAEX = 'exists([Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", Value == "domain users' SID"]) && NOT exists([Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", Value == "EX_MFA's SID"]) => issue (Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod", Value = "http://schemas.microsoft.com/claims/multipleauthn");'

 

$RelayParty = Get-AdfsRelyingPartyTrust -name "Relay Party Name in ADFS"

 

Set-AdfsRelyingPartyTrust –TargetRelyingParty RelayParty –AdditionalAuthenticationRules $MFAEX

After applying the new rule, you will not be able to amend on MFA setting of the relay party from GUI, and you have to return the old value of AdditionalAuthenticationRules.