title: ADFS PowerShell Claims Rule Combination Sytax
body: <p>After some success with simple rules, having trouble in ADFS Claim Rules PowerShell SnapIn with:</p>
  
  <ol>
  <li>How to delete rules. EDIT: => poor man's way appears to be just define a new empty rule set.</li>
  <li>How to append rules without setting them all in one command.</li>
  <li>Syntax for logical decisions within a rule. My attempt:</li>
  </ol>
  
  <hr>
  
  <pre><code>Set-AdfsAdditionalAuthenticationRule -AdditionalAuthenticationRules 'c1:[type ==
  "http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork", value == "false"] &amp;&amp; 
  (NOT EXISTS([type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-ip",
  Value =~ "^(?i)2003:6a:7d12:3f58:148:f23:cdc4:4181$"])) 
   =&gt; issue(type =
  "http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod", value =
  "http://schemas.microsoft.com/claims/multipleauthn" );'
  </code></pre>
  
  <p>Produces an error at the "NOT EXISTS" no matter what I do. Any help greatly appreciated. The idea is to require all external IPs except the one in the list of IPs (regex) to use MFA.</p>
  
  <p><strong>EDIT: I TRIED THE FOLLOWING</strong></p>
  
  <p>the only thing that I still can't get working is the IP-address check. Is there a way I can debug to see what is happening (ip found or result of regex etc.)?</p>
  
  <pre><code>$RhtMfaClaimRule = 'NOT EXISTS([type == 
  "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-ip", Value =~ "^(?i)81.151.139.145$"]) =&gt; add(type = "http://schemas.company.com/temp", value = "true" ); 
  c1:[type == "http://schemas.company.com/temp"] &amp;&amp; 
  c2:[type == "http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork", value == "false"] =&gt; issue(type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod", value = "http://schemas.microsoft.com/claims/multipleauthn" );'
  
  Set-AdfsAdditionalAuthenticationRule $RhtMfaClaimRule
  </code></pre>
  
  <p><strong>EDIT: Learned from logging</strong>
  The rules appear to be ok since a regexp of ".asterix" for the filtered IP turns off MFA from external as expected. But as soon as I change it to anything but .asterix, I get prompted for the MFA again. So, suspecting the client-ip claim, looking at the logs. I see the calling IP is visible in the request context header, so far so good, but in the thousands of trace entries, I do not see the client-ip claim yet. I suspect I have to tell Office365 to forward this somewhere in my ADFS-daschboard "Edit Claim rules for Microsoft Identity Platform". Any idea what I need to precisely add there for this client-ip claim to be forwarded? </p>
  
  <p><strong>EDIT. Probably SOLVED</strong></p>
  
  <p>The posts shown below helped. The ms-client-ip claim used above is apparently only for inhouse clients. Desperation led me to really look at the claim details, and replacing the x-ms-client claim with the following one from the request context apparently does the trick -- initial tests successful. </p>
  
  <p><a href="http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip" rel="nofollow">http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip</a></p>