• 619-292-0800
  • sales@agileit.com
  • San Diego, CA
Contact

Disable Extended Protection in ADFS 2.0 for NTLM

You must disable Extended Protection in ADFS 2.0 (Office 365 SSO) to allow IE, Google Chrome and Firefox to Authenticate Using NTLM when using reverse proxies such as TMG and UAG…or external employee access. To learn about the security implications of disabling Extended Protection, you can read the Microsoft security advisory here.

In the past, this was a manual process on each server in the farm (for example, this process). ADFS 2.0 requires you to disable IIS Windows extended protection on the ADFS virtual directory “LS”.

This can now be set via PowerShell at the farm level easily using PowerShell.

  1. Open PoweShell Command Window
  2. Load ADFS Poweshell SnapIn Add-PsSnapIn Microsoft.Adfs.Powershell
  3. Set ADFS to diable EAP at the farm level Set-ADFSProperties -ExtendedProtectionTokenCheck:None
  4. Restart ADFS and IIS
    • IISReset
    • Net Stop ADFS
    • Net Start ADFS

Hope this helps!

PS – Uploaded to the wiki here.

Looking for further help? Please check us out for your Managed Service or Cloud Consulting needs.

ON THIS PAGE

Looking to hire an MSP for CMMC?

Click the button below now.

Schedule a Consultation

Lorem ipsum dolor sit amet,

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec

Compliance Isn't a Checkbox

It’s contract eligibility. Agile IT builds, secures, and validates Microsoft 365, GCC High, and Azure environments for organizations facing CMMC, NIST 800-171, and CUI requirements. If a failed audit would cost you contracts, talk to us before it does.

Schedule a Consultation
Picture of Maggie McGrath
Maggie McGrath
Chief of Staff Over twelve years at Agile IT, Maggie McGrath has run nearly every part of this business, including as Chief Operating Officer. She knows it from the inside out. As Chief of Staff, Maggie is the integrator. She moves between every department, translating strategic vision into deliverables, holding the organization accountable to both, and keeping every part of the company pulling together. When Agile IT commits to something, Maggie is the reason it happens. She holds her Certified CMMC Practitioner certification and is earning her Certified CMMC Assessor credential. She treats the detail as what it is: the place where the mission is either protected or lost. The standard she sets for the team starts with her. This was never just a job to her. As a mother and a citizen, protecting this country’s future is the reason she shows up. The work Agile IT does, supporting the organizations that safeguard sensitive information and fulfill federal contracts, is her way of safeguarding the future for the families of America. Twelve years in, it still is.

Related Posts

What Counts as CUI in Microsoft 365 and Azure Government

July 29, 2026

Most CUI scope decisions get made in one meeting, by whoever is in the room, and documented afterward to match. That boundary holds until a C3PAO asks who justified it. The designating agency decides what qualifies. Data flow decides what’s in scope. The Microsoft environment follows both, not the reverse.

Read More »