Azure AD 3rd Party MFA Azure AD Custom Controls

How to Use Third-Party MFA Providers with Azure AD Custom Controls

Azure Active Directory (Azure AD) is a cloud-based identity and access management service that provides secure sign-in and access to applications and resources. Azure AD supports multi-factor authentication (MFA), which is a method of verifying your identity using two or more factors, such as your password and a verification code sent to your phone.

However, some customers may want to use their existing third-party MFA solutions with Azure AD, such as Duo, RSA, or Trusona. These solutions may offer additional features or integrations that are not available with the built-in Azure AD MFA. To enable this scenario, Azure AD offers a preview feature called custom controls.

Custom controls are a way of integrating third-party MFA providers with Azure AD Conditional Access, which is a tool that allows you to enforce policies based on user, device, location, and application context. With custom controls, you can redirect your users to a compatible service to satisfy authentication requirements outside of Azure AD. For example, you can require users to verify their identity with Duo before accessing a sensitive application.

In this article, we will show you how to create and use custom controls with Azure AD Conditional Access.

Prerequisites

To use custom controls, you need the following:

An Azure subscription with an Azure AD Premium license

A third-party MFA provider that supports custom controls integration

A JSON data block from the third-party MFA provider that defines the custom control

Creating a custom control

To create a custom control, follow these steps:

Select Conditional Access and then Custom controls.

Select New custom control at the top of the page.

Paste the JSON data block from the third-party MFA provider into the textbox. Do not make any changes to the JSON unless you explicitly understand the change you are making.

Select Create.

You should see your custom control in the list of available controls.

Using a custom control in a Conditional Access policy

To use a custom control in a Conditional Access policy, follow these steps:

Select Conditional Access and then Policies.

Select New policy or edit an existing policy.

Under Assignments, configure the users, groups, applications, and conditions that you want to apply the policy to.

Under Access controls, select Grant.

Select Require one of the selected controls.

Select your custom control from the list of available controls.

Select Select.

Select Enable policy.

Select Create.

Your policy is now active and will enforce your custom control for the specified users and applications. ec8f644aee