
I know there is no cleaner solution here today. You need to set up RD Gateway and NPS Server. This is possible only for devices joined to Azure AD. Logins to Windows on domain joined computers outside of the corporate network IOS mail app supports MFA but not for deployment scenarios.

Yes, if you go with billing model you won't be able to use option 1 You're right about Azure MFA billing and licensing. Hopefully someone that has gone through this process can explain this. I have lurked tech net forums and read a bunch of articles already and still very confused. My understanding is MFA is offered through Azure AD Premium (P1) and IIRC I read somewhere that it is required for HMA?ĭoes MFA work for all Exchange services? (EAS, EWS, OWA, ActiveSync, Outlook Anywhere) What licensing do I need? We have a EA with MS. How does HMA tie into all of this? Can it be used with on-premise MFA server?

Configure OWA for claims-based auth to ADFS.Publish OWA using Azure AD App Proxy and use cloud-based MFA with Azure AD OR MFA Server with ADFS.I understand for MFA there are two options: I also would like to take advantage of Hybrid Modern Authentication for better/seamless SSO with Outlook during password changes, etc. We have a Exchange 2013 on-premise that is hybrid with O365 where we have mailboxes on-premise, hybrid (primary on-premise and archive in the cloud), and fully cloud.
