microsoft nps mfa extension

Question

Hello together,

we want to use microsoft nps server with azure mfa extension in future.
I got this working so far, but i have one question related to radius access-challenge messages.
If i authenticate via azure mfa extension and entered the first factor (username and password) i didn't receive any information what to do. For example a text mesage like this
"Please confirm multi factor authentication". Please notice: I receive the multi factor prompt, but i wish to inform the user, that the system is waiting for the second factor of authentification.
Is there any opportunity to send a Radius Access-Challenge Message with Attribute Type 18 (Reply-message)?
Is this anywhere working like explained?

Thanks for information

Regards
Alexander

Answer 1

Hi Alexander,

Just check this page and it has some steps KB44686 also follow this article and should help you in configuration of policies for Radius - howto-mfa-nps-extension
Hope this helps.

---

Please don't forget to upvote and Accept as answer if the reply is helpful

If this answer helped you please mark it as "Verified" so other users can reference it.

Answer 2

Hello @Alexander Bussohn ,

I would recommend checking what does NPS extension server log shows under path:

Applications and Services Logs > Microsoft > AzureMfa > AuthN > AuthZ

and based upon the error's please validate the following:

• The NPS server is unable to receive responses from Azure AD MFA. Verify that your firewalls are open bidirectionally for traffic to and from https://adnotifications.windowsazure.com and that TLS 1.2 is enabled (default). If TLS 1.2 is disabled, user authentication will fail and event ID 36871 with source SChannel is entered in the System log in Event Viewer. To verify TLS 1.2 is enabled, see TLS registry settings.
• Verify that you can reach https://adnotifications.windowsazure.com and https://login.microsoftonline.com/. If those sites don't load, troubleshoot connectivity on that server.
• Verify that your firewalls are open bidirectionally for traffic to and from https://adnotifications.windowsazure.com and https://login.microsoftonline.com using ports 80 and 443. It is also important to check that on the DIAL-IN tab of Network Access Permissions, the setting is set to "control access through NPS Network Policy"

Thanks
Akshay Kaushik

Please "Accept the answer" and "Upvote" if the suggestion works as per your business need. This will help us and others in the community as well.

Answer 3

I believe I have done all this and still don't get the MFA prompt???