To improve Windows Server I suggest you ...

Significantly increase the number of Banned IPs that can be stored in ADFS.

ADFS 2019 allows for 300 IPs to be added to the "Banned IP list"

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-banned-ip#adding-banned-ips

As there are nearly four billion public IPs on the internet, 300 is woefully inadequate.

Small customers that are only trying to block a few users aren't likely using ADFS anyway. Large organizations that rely on ADFS will hit the 300 limit almost immediately.

I'd like to see this number raised to 65538 (/16) or something similar.

7 votes
Sign in
(thinking…)
Password icon
Signed in as (Sign out)

We’ll send you updates on this idea

Mike Crowley shared this idea  ·   ·  Flag idea as inappropriate…  ·  Admin →

3 comments

Sign in
(thinking…)
Password icon
Signed in as (Sign out)
Submitting...
  • Anonymous commented  ·   ·  Flag as inappropriate

    The "set-orgconfig" to block iP's from being routed to on-prem ADFS is good to protect for that kind of attach, but a target attack against your public ADFS is still a huge problem and should definitely have more than 300 addresses in the block list! //K

  • Mike Crowley commented  ·   ·  Flag as inappropriate

    Not to take wind out of my own sail here, but FYI:

    If you are attempting to block IPs for use with Office 365 federation, you can do this directly in the tenant via Set-OrganizationConfig -IPListBlocked. In my testing, I was able to add ~1173 entries. Listed IP addresses will not be proxied to AD FS for authentication.
    ref: https://www.slideshare.net/AndresCanello/azure-ad-password-attacks-logging-and-protections

Feedback and Knowledge Base