Delegate NEw TOTP Key to Helpdesk

[jojobgl]

Hello,

I read in the Changelogs, that it should be possible to give non ADFS Admins the right to set new TOTP Keys for Users.

We want set the possiblity to our Helpdesk.

How is this possible, in the Documentation I found nothing.

[redhook62]

Hi, @jojobgl

Yes, it is possible to let operators who are neither domain administrators nor local administrators manage the majority of the settings of the MFA module. However, this functionality is specific to ADFS and not to the MFA module.
You must first have a dedicated Group in your Active Directory for example "ADFS HelpDesk", then you must in the ADFS configuration (ADFS Console) assign this group to the "ADFS Delegated Administrators"

Then your helpdesk will be able to use powershell commands and the administration console. refer to the list of supported Powershell commands (marked A).

To generate a TOTP key,
you can use the Add-MFAUsers and Set-MFAUsers commands. ou managing users in MMC console (user properties)

get-help Add-MFAUsers -Detailed
get-help Set-MFAUsers -Detailed

Bulk import
get-help Import-MFAUsersADDS -Detailed
get-help Import-MFAUsersCSV -Detailed
get-help Import-MFAUsersXML -Detailed

regards

[jojobgl]

I tested it, but is this also remote possible?

I installed the mmc on another machine and only get the "you have to be admin" message.

[redhook62]

Hi @jojobgl

There are prerequisites, have you read them?

It is indicated that certain PowerShell commands can be executed remotely (using the Windows WinRM infrastructure)

Under no circumstances should you install the console on another machine, this will never be the case, the plugin should only be installed on ADFS servers (not WAP proxies). This is not supported! and for security reasons it never will be.

If your HelpDesk operators are ADFS delegated administrators, they have every right to access ADFS machines (with restricted possibilities),

these rights are granted in the ADFS configuration and the plugin only respect this configuration.
Furthermore, this is the responsibility of Microsoft, and you may find that the ADFS console cannot be used remotely.

regards