When you should use Azure MFA and when you should use MFA Server

MFA for AD is challenging: native support is smartcards only, so organizations layer Windows Hello for Business or Duo on endpoints. Covers on-prem and hybrid options including Entra Connect.

Covers hybrid identity risks—SolarWinds-style attacks pivot from on-prem AD into Azure AD—and recommends MFA plus AD Pass-through Authentication over legacy ADFS to shrink the attack surface.

AADInternals creator Dr. Nestori Synnimaa joins the HIP Podcast: every on-prem component in a hybrid AD configuration needs Tier 0 protection, and Azure AD sync compromise can expose credentials across both environments.

Why it may be time to leave ADFS in hybrid environments: its complexity expands the attack surface, and SolarWinds showed an on-premises flaw can compromise the Azure AD tenant; Microsoft recommends migrating to Azure AD Application Proxy.

As enterprises integrate Microsoft Entra ID (formerly Azure AD) with on-prem AD, this piece examines hybrid identity risks—above all permission sprawl—and urges a look-before-you-leap approach to cloud identity adoption.

Azure AD Connect syncs 151 attributes by default and they can't be fully removed later; Semperis' Darren Mar-Elia recommends app, attribute, domain and OU filtering to limit exposure in Azure AD.