Many organizations continue to operate business-critical deployments of Microsoft Dynamics CRM or Dynamics 365 Customer Engagement on-premises. These environments typically rely on on-premises Active Directory Federation Services, claims-based authentication, and Internet-Facing Deployment (IFD) to provide secure access for internal and remote users.

Microsoft supports AD FS as the security token service for Dynamics 365 Customer Engagement on-premises. Dynamics 365 can use claims-based authentication for internal access and IFD for external access, with AD FS issuing the security tokens consumed by CRM.

However, organizations that want to add modern multifactor authentication to this architecture face a difficult choice. Many MFA products are designed primarily for cloud services, rely on an external authentication platform, or provide only a general AD FS integration without addressing the operational requirements of Dynamics CRM on-premises.

The exact scenario we addressed

The solution was designed for the following architecture:

This is an important distinction. Generic AD FS MFA products can potentially protect browser-based relying parties.

MachSol’s implementation is focused specifically on environments where Dynamics CRM, AD FS, MFA processing, authenticator records, recovery state, and encryption controls must all remain on-premises.

How the solution works

The MachSol MFA Adapter integrates with the external authentication-provider framework in AD FS. Microsoft supports custom external authentication providers and documents the interfaces required to participate in the AD FS authentication pipeline.

The user journey

1	The user opens Dynamics CRM.
2	Dynamics CRM redirects the user to AD FS.
3	AD FS completes the existing primary authentication process.
4	AD FS invokes the MachSol MFA Adapter.
5	A new user is guided through authenticator registration using a QR code.
6	The user enters the current code generated by a compatible authenticator application.
7	The adapter verifies the code and records the enrollment securely.
8	AD FS issues the authentication token required by Dynamics CRM.
9	Returning users are prompted only for the current authenticator code.

The enrollment and verification experience is embedded directly into the AD FS authentication journey. No separate cloud enrollment portal is required.

Production capabilities

Standards-based authenticators Time-based one-time passwords (TOTP) let users register any compatible authenticator app by scanning a QR code.	Encrypted secret storage Authenticator secrets are encrypted before storage, using a certificate maintained in the customer’s own infrastructure.
Inline enrollment QR setup, manual setup-key support, clear privacy guidance, code confirmation, and responsive screens — all inside AD FS sign-in.	SQL-backed state Enrollment status, encrypted active and pending secrets, counters, lockout state, recovery challenges, and audit events.

SQL-backed authentication state

SQL Server maintains:

●  User enrollment status ●  Encrypted active and pending secrets ●  Last accepted TOTP counter ●  Failed-attempt state ●  Temporary lockout state

●  Enrollment expiration ●  Recovery challenges ●  Notification processing state ●  Audit events

TOTP replay protection

A mathematically valid code should not automatically be accepted more than once. The adapter records the last accepted TOTP counter and uses an atomic SQL update to require:

This helps prevent the same authenticator code from being reused within its validity period and supports consistent behavior across multiple AD FS nodes.

Failed-attempt controls and lockout

The solution tracks unsuccessful verification attempts within a configured time window. When the configured threshold is reached, the MFA record can be temporarily locked to reduce repeated guessing attempts.

Secure email-assisted recovery

An enrolled user who can no longer use the registered authenticator can request a temporary, single-use recovery code through the email address associated with the account. The recovery design includes:

●  Configurable code length ●  Configurable expiration ●  Maximum verification attempts ●  Resend cooldown ●  Hourly request limits

●  Hashed recovery-code verification ●  Single-use challenge consumption ●  Auditable recovery events ●  Customer-controlled email delivery via SQL Server Database Mail

Authenticator replacement

After a recovery code is successfully verified, the user enters a controlled replacement workflow:

The new authenticator is not activated merely because the QR code was displayed. Activation occurs only after a valid code from the pending authenticator is confirmed.

Notification queue and retention controls

Recovery messages are processed using a database-backed notification queue and an approved SQL Server Database Mail profile. The hardened processing design includes:

●  Atomic notification claiming ●  Delivery-attempt tracking ●  Controlled retry behavior ●  Prevention of duplicate active recovery challenges

●  Plaintext recovery-message cleanup ●  Retention-based deletion of completed operational records ●  Separate audit retention

Operational logging

The adapter writes operational and security events to the Windows Application event log. Correlation IDs allow administrators to connect the user-facing support reference, AD FS activity, adapter events, recovery processing, and authentication success or failure. Sensitive authenticator secrets and recovery codes are not intended to be written to the audit log.

Controlled MFA exemptions for CRM integrations

Not every Dynamics CRM connection is an interactive browser session. CRM environments may include:

●  Background services ●  Scheduled integrations ●  Email-processing components ●  Monitoring systems

●  Custom websites ●  Deployment tools ●  SDK applications ●  Approved service accounts

Some non-interactive processes cannot respond to a QR enrollment page or enter a one-time authenticator code. Dynamics 365 Customer Engagement on-premises supports several authentication models and client patterns, so each integration must be evaluated according to the protocol and client behavior it uses.

MachSol’s solution includes the ability to support controlled, policy-based MFA exemptions for specifically approved users and integration scenarios. An exemption is not intended to disable MFA generally. Exemptions should be:

●  Explicitly authorized

●  Narrowly scoped

●  Documented and auditable

●  Regularly reviewed

●  Restricted to the required relying party or integration scenario

Normal interactive CRM users continue to be protected by MFA.

Why this matters

Many organizations cannot move every identity, application, or security process to a public cloud platform. Common requirements include:

●  Data-sovereignty restrictions ●  Regulated customer environments ●  Restricted internet connectivity ●  Existing Dynamics CRM investments

●  Customer-controlled encryption keys ●  Local audit and recovery requirements ●  Predictable service-provider operations ●  No dependency on an external MFA cloud service

More than a CRM-only technical component

The core technology is implemented as an AD FS external authentication provider. Architecturally, it can be evaluated for other compatible browser-based AD FS relying parties. Potential future application profiles may include:

●  SharePoint Server on-premises ●  Internal business portals ●  Custom ASP.NET applications

●  WS-Federation applications ●  SAML relying parties ●  Applications published through Web Application Proxy

Each application still requires protocol, claims, client, service-account, and integration testing. The initial product focus remains Dynamics CRM and Dynamics 365 Customer Engagement on-premises, because that is the environment for which the solution was specifically developed and production deployed.

A specialized on-premises security capability

MachSol has now developed a purpose-built MFA capability for this exact scenario:

Publicly available vendor documentation shows several generic AD FS MFA options, but the market appears to have limited purpose-built offerings that combine this complete Dynamics CRM on-premises operating model with local MFA processing and CRM-focused deployment support.

For Dynamics CRM customers, hosting providers, and regulated organizations, this represents an opportunity to strengthen authentication without abandoning the existing on-premises platform or surrendering control of sensitive authentication data.

Next steps

MachSol is continuing to mature the solution through:

●  Wider AD FS version validation ●  Dynamics CRM compatibility testing ●  Automated installation and rollback ●  Farm deployment verification ●  Administrative management tooling

●  Security assessment and penetration testing ●  Health monitoring and diagnostics ●  Database migration and retention tooling ●  Customer pilot planning ●  Product licensing and support documentation