Step by Step – ADFS – issue MFA-performed claim when using PhenixID Authentication Services as Claims Provider


This document will guide you through the steps to send a claim to a relying party from ADFS, indicating that MFA was performed, when PhenixID Authentication Services is used as the claims provider.


In some use cases it is required that the authentication takes place with an external claims provider, such as PhenixID Authentication Services. Some Microsoft relying parties, such as M365 or other Azure-based services, might have access rules stating that the service/rp can only be accessed using multi-factor authentication. Such relying parties look for a specific claim in the assertion to verify that ADFS has performed MFA.

System Requirements

  • PhenixID Authentication Services added as a Claims Provider in ADFS
  • PhenixID Authentication Services Identity Provider (Claims provider) setup with MFA method(s)


Configure PhenixID Authentication Services SAML attribute release

  1. Login to Configuration Manager
  2. Navigate to the IDP used
  3. Click Execution flow
  4. Make sure the item property is added with the value
  5. Add the property to the list of additional attributes on the AssertionProvider.
  6. Click Save

Create Passthrough claim rules

  1. Open ADFS Management console
  2. Navigate to the Claims Provider
  3. Edit claim rules
  4. Add a Passthrough rule
  5. Navigate to the relying party
  6. Edit claim rules
  7. Add a Passthrough rule


1. Browse to the RP

2. Redirect to ADFS

3. Redirect to PhenixID Authentication Services

4. Authenticate (MFA)
5. Redirect to ADFS

6. Redirect to RP (no additional MFA should be required)

Information provided in this document is for your information only. PhenixID makes no explicit or implied claims to the validity of this information. Any trademarks referenced in this document are the property of their respective owners.

The origin of this information may be internal or external to PhenixID. PhenixID makes all reasonable efforts to verify this information.

PhenixID -