Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In setting up SSO for Office 365, in order to make Chrome and Firefox access services on the Intranet, Extended Protection for Authentication must be disabled on the ADFS sever.

As the ADFS server is only accessible on the Intranet, and any external logins are handled by the ADFS proxy server, is there a major security concern in regards to turning Extended Protection off?

share|improve this question
Is this what you're looking for: Extended Protection” primer and implementation guide to prevent MITM – LamonteCristo Nov 20 '12 at 23:28

I think you don't have to disable (ExtendedProtectionTokenCheck=None) extended protection, you just need to make it optional (Allow instead of Require).

This allows to connect incompatible clients without this protection (and vulnerable to MITM) but also allows InternetExplorer to use the additional protection. However there is no way to enforce this on the client, so it gets vulnerable to a downgrade I think.

An idea would be, that you have a special endpoint which allows skipping extended protection but will not be used by regular clients. Then only your alien clients will be vulnerable to the MITM problem. Depending on other factors this might be however not a big risk. If your employees are used to go to lunch without locking their screens you don't have to worry about it :)

MS Documentation is here:

share|improve this answer
What are the "other factors" that help determine if this is a risk or not? – Luke Sep 17 '14 at 17:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.