Step #6: Apply access control policy changes in LastPass

The LastPass Custom Attribute Store installed “LastPass Trust” Relying Party Trust on your AD FS server(s).

Log in to your primary Active Directory Federation Services (AD FS) server
Navigate to your AD FS Management Settings.
Go to Trust Relationships > Relying Party Trust in the left navigation, then follow the next steps based on your AD FS server version:
- AD FS Server 3.0 – Windows Server 2012 R2
  1. In the "LastPass Trust" section in the right navigation, click Edit Claim Rules....
  2. Select the Issuance Authorization Rules tab and set your desired rule, which will define how users are authenticated when logging in to LastPass via federated log in using AD FS.
- AD FS Server – 4.0 Windows Server 2016 or Windows Server 2019 or Windows Server 2022
  1. In the "LastPass Trust" section in the right navigation, click Edit Access Control Policy....
  2. Set your desired policy, which will define how users are authenticated when logging in to LastPass via federated log in using AD FS.

Results:

You have successfully set up Active Directory Federation Services (AD FS) for your LastPass Business account. All of your newly populated federated users will receive a Welcome email informing them that they can now log in and use LastPass.

What to do next:

To see your end user's experience, please see Federated login experience for LastPass Business users.
For additional help with troubleshooting, please see Troubleshooting federated login for Active Directory Federation Services (AD FS).
To provision non-federated users with a federated account, please see How do I convert an existing LastPass user to a federated (AD FS or PingFederate) user?
To learn how to migrate from using AD FS to a cloud-based federated login (Okta or Azure AD), please see How do I migrate from using AD FS or PingFederate to a cloud-based federated login identity provider for LastPass?

Parent article: Set up federated login for LastPass using AD FS

Previous article: Step #5: Register your custom attribute with LastPass