title: Browser requests from Azure AD Joined machines never pass through ADFS. Why?
body: <p>We noticed that, on Azure AD Joined devices on the internet, the browser requests to authenticate on web resources protected by Azure AD (e.g. authentication on office.com) do not pass through ADFS, despite the fact that we have federated authentication in Azure AD. <strong>Why this happen?</strong></p>
  <p>We also noticed that the MFA challenge is requested only once, on the very first user access to any Azure AD protected resource, despite the fact that we have not allowed MFA token caching (we unchecked the option: “Allow users to remember multi-factor authentication on devices they trust”). <strong>Why this happen?</strong></p>
  <p>Where are these behaviors documented?</p>
  <p>NOTES:</p>
  <ul>
  <li>In our tests, the PCs are on the internet (not on the internal network)</li>
  <li>On the Azure AD sign-in logs, we see that, every time a user login to the Azure AD Joined PC, there is a Windows Sign-In event logged with source IP equal to the internal IP of the Load Balancer in front of ADFS. That authentication then goes through ADFS. As said, this event does not appear in the logs when the signed-in user then authenticate to a web page protected by Azure AD.</li>
  <li>Our Conditional Access policy asks for MFA on every access with the single exclusion of &quot;trusted networks&quot; that, in our case, corresponds to the MFA option &quot;Skip multi-factor authentication for requests from federated users on my intranet&quot;</li>
  <li>We are doing our tests on Chrome browser with the W10 Account extension installed for the  current user (but no profile authenticated) and on Edge with the profile authenticated with the same user who did the windows sign-in. Same behavior.</li>
  <li>If we repeat the tests on the same PC, with another account not having the W10 Account extension installed on Chrome, the behavior on Chrome is completely different: we go through the authentication in ADFS and the MFA challenge, exactly as we see on PC not Azure AD Joined.</li>
  </ul>
  <p>Thank you</p>