In setting up SSO for Office 365, in order to make Chrome and Firefox access services on the Intranet, Extended Protection for Authentication must be disabled on the ADFS sever.
As the ADFS server is only accessible on the Intranet, and any external logins are handled by the ADFS proxy server, is there a major security concern in regards to turning Extended Protection off?
