Share via

Connecting to Azure Windows Server 2019 via Remote Desktop with MFA for AAD registered Windows 10 clients

Cache Moneyz 1 Reputation point
2022-10-28T20:08:38.52+00:00

Hello, I am having trouble determining the best route for this, or if it is possible at this time.

I have a Windows Server 2019 Data Center VM in Azure and a local WORKGROUP lab of 2 Windows 10 PCs. Both PCs are Registered to Azure AD with AAD users assigned AAD MFA licenses. The 2019 Server VM is Azure AD joined to the same Azure tenant as the AAD users.

In this lab I am looking to configure the AAD Users to connect to the Windows Server 2019 VM via Remote Desktop from the PCs. The requirements would be that the AAD user utilize their AAD/Azure credentials to authenticate to the Azure server. Sign-on should also require MFA/2FA via Azure AD, MS Authenticator, PIN, or text message verification.

The basic flow would be:
User log into AAD Registered PC -> RDP Connect to 2019 Server -> Enter AAD User credential -> Complete MFA/2FA -> Log onto Server

Additional info:
PCs are workgroup machines - no Active Directory (besides AAD Registration)
No local account's will be allowed RDP login on the server - only granted AAD users via IAM membership.

Is this possible with today with Microsoft's offerings? If so, is there a clear path for deploying this? I'm happy to keep on digging to figure this out, but I don't want to be reinventing the wheel if this is already a documented practice.

Thank you in advance!!!

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Cristian SPIRIDON 4,486 Reputation points Volunteer Moderator
    2022-10-29T05:42:00.827+00:00

    Hi ChrisEstrada-0817,

    Windows login or RDP can't be done with Azure MFA.
    There are options like Windows Hello for Business or NPS extension for RDP but they require you to have an on prem infrastructure.
    One solution to protect the Windows Server would be to have it behind a VPN that require MFA.

    Hope this helps!

  2. Akshay-MSFT 17,956 Reputation points Microsoft Employee Moderator
    2022-11-02T06:04:03.037+00:00

    Hello @Cache Moneyz

    You can achieve these requirements by using Azure AD MFA Service, you can directly use the Azure MFA Service to trigger MFA when doing RDP to your Windows machines, with the help of NPS Extension. The purpose of the NPS extension is to translate the NPS RADIUS calls to REST (HTTPS) calls that Azure AD supports and directly leverage the Azure AD MFA, without needing to have on-prem MFA server.

    Below are the prerequisites:

    • Remote Desktop Gateway
    • Azure AD MFA License
    • NPS Server with NPS Extension installed
    • Azure Active Directory synched with on-premises Active Directory

    Once the above prerequisites are checked, you can follow *Integrate your Remote Desktop Gateway infrastructure using the Network Policy Server (NPS) extension and Azure AD* for step-by-step instructions.

    Note: The MFA method that you choose must not require users to input any type of code/OTP for 2nd factor of authentication as the Remote Desktop Connection doesn't provide you with an option to enter a code. So, you must choose Phone Call or Authenticator App notification (not Authenticator App with Code) and the SMS method won't work in this case.

    Please do let me know if you have any queries in the comments section.

    Thanks,
    Akshay Kaushik

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.