ADFS and BYOD in azure

Question

Hello ,
We are in the process of moving all servers into azure , and deploying BYOD infrastructure hence no need for clients machine to be joined to the domain “obviously”
My question is , if my clients are non-domain joined ? why do I need to deploy ADFS in azure at all ? since no on premise servers anyways 

Answer 1

Avoiding Federation Now That Password Hash Sync Is Available
A key driver for federation deployments with ADFS used to be that it enables users to use a single password across on-premises and cloud sessions. However, federation deployments take some effort due to the additional servers and network implementation.
The on-premises servers also have to be Internet accessible through any corporate firewalls in a secure way, and they also have to be highly available since logins are not possible if they or their Internet connectivity are offline. Because password hash sync
is a feature of directory synchronization, it is initiated from the on-premises server and doesn’t incur many of the infrastructure requirements and costs of federation. It only requires a single server and whilst that server requires outgoing access to the
Internet in order to connect to Azure AD there is no requirement for inbound connections, custom firewall openings or highly available configurations.
There are still some reasons why some customers will still prefer ADFS and directory federation over DirSync and password hash synchronization. These include:
ADFS can be configured such that users who are already logged on to a domain joined and connected machine do not require any password re-entry to sign in at Office 365. This gives you true single sign-on since re-entry of the password is not required. With
DirSync and password hash synchronization a user must still re-enter their password, although it will be the same password as they use on-premises.
ADFS allows for client access filtering, which restricts access to Exchange Online to users based on their IP address.
ADFS will honor Active Directory configured login time restrictions for users.
ADFS can include web pages for users to change their passwords while they are outside the corporate network.
With ADFS the authentication decision is always made on-premises and no password hashes are synchronized to the cloud. This may be obvious but can be sometimes a security policy requirement.
With ADFS an administrator can immediate block a user to remove access where-as DirSync synchronizes these changes every three hours. Only password changes are synchronized by DirSync every two minutes.
ADFS permits use of on-premises deployed multi-factor authentication products. Note that Azure AD supports multi-factor authentication but many third party multi-factor authentication products require on-premises integration.
Where Microsoft Forefront Identity Manger (FIM) is required for some other FIM capability. FIM directory synchronization does not include password hash synchronization so ADFS will still be required for SSO login.
Some on-premises to cloud hybrid scenarios require ADFS such as hybrid search.
If you need any of these then Active Directory Federation Services is still the best option.