When implementing MFA with Active Directory Federation Services (ADFS), choosing between classic authorization rules and modern access control policies significantly impacts maintainability. Authorization rules use a proprietary claim rule language, are per-trust only, and become hard to manage at scale. Access control policies, introduced in Windows Server 2016, offer reusable named policy objects with structured conditions including built-in MFA enforcement. The two mechanisms are mutually exclusive on a single relying party trust, so migration must be planned carefully. For any new MFA rollout, access control policies are the recommended approach due to their reusability, auditability, and cleaner abstraction.
Table of contents
A tale of two mechanismsAuthorization rules: the classic approachAccess control policies: the modern approachSide-by-side: the key differencesWhy the switch matters for MFAConclusionSort: