During a Windows 10 Pilot a customer told me, that on Windows 10 Systems the ADFS didn’t work as expected when they use EDGE.
Intranet Users with EDGE get the regular SSO Page like every external user.

With a few tweaks, I could solve that and now the Single-Sign-On via ADFS works like on Internet Explorer:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
<#
  Tweaked Version that prevents the Auth Pop-Up on non Windows devices a bit better
  These Devices should get the regular Forms based (HTML Page) instead.
  
  I was asked: Nope, 'Mozilla/5.0 (Windows NT' is correct, not an error 😉
#>

# Execute this on your ADFS Server
# If you have more then one, use your primary ADFS server, this is essential!
Set-ADFSProperties -ExtendedProtectionTokenCheck None

# Should be:
# MSAuthHost/1.0/In-Domain
# MSIE 6.0
# MSIE 7.0
# MSIE 8.0
# MSIE 9.0
# MSIE 10.0
# Trident/7.0
# MSIPC
# Windows Rights Management Client

# Check the NTLM enables User Agents
Get-ADFSProperties | Select-Object  -ExpandProperty WIASupportedUserAgents

# Now we append the User Agent 'Windows NT 10.0; WOW64; Trident/7.0', 'Edge/1', 'Mozilla/5.0 (Windows NT' to the List
Set-ADFSProperties -WIASupportedUserAgents @('MSIE 6.0', 'MSIE 7.0', 'MSIE 8.0', 'MSIE 9.0', 'MSIE 10.0', 'Trident/7.0', 'MSIPC', 'Windows Rights Management Client', 'Windows NT 10.0; WOW64; Trident/7.0', 'Edge/1', 'Mozilla/5.0 (Windows NT')

# Optional: Handle the Fallback for non Windows devices a bit better
Set-AdfsGlobalAuthenticationPolicy -PrimaryIntranetAuthenticationProvider @( 'WindowsAuthentication', 'FormsAuthentication' ) -WindowsIntegratedFallbackEnabled $true

# Restart the ADFS services# If you have more then one ADFS Server, you need to execute that against all of them!
Restart-Service -Name adfssrv

# Check that the ADFS Service is running
Get-Service -Name adfssrv

# Check the NTLM enables User Agents
Get-ADFSProperties | Select-Object  -ExpandProperty WIASupportedUserAgents

# Now it should be:
# MSIE 6.0
# MSIE 7.0
# MSIE 8.0
# MSIE 9.0
# MSIE 10.0
# Trident/7.0
# MSIPC
# Windows Rights Management Client
# Windows NT 10.0; WOW64; Trident/7.0
# Edge/1
# Mozilla/5.0 (Windows NT

# More Info: https://technet.microsoft.com/en-us/library/ee892317.aspx

Code should be documented enough inline, so the GIST is the documentation 😉

Update:
After a bit more testing, I found that the old ‘-WIASupportedUserAgents’ wasn’t the best guess. I fixed that and mobile devices now get the Forms based login instead of the Auth Pop-Up.

Here is the Change:

1
Set-ADFSProperties -WIASupportedUserAgents @('MSIE 6.0', 'MSIE 7.0', 'MSIE 8.0', 'MSIE 9.0', 'MSIE 10.0', 'Trident/7.0', 'MSIPC', 'Windows Rights Management Client', 'Windows NT 10.0; WOW64; Trident/7.0', 'Edge/1', 'Mozilla/5.0 (Windows NT')

And you might also want to consider this:

1
Set-AdfsGlobalAuthenticationPolicy -PrimaryIntranetAuthenticationProvider @( 'WindowsAuthentication', 'FormsAuthentication' ) -WindowsIntegratedFallbackEnabled $true

Tested with ADFS on Windows Server 2012R2 and on Server 2016.