NPS Extension for Azure AD MFA - Require OTP in mobile application

Question

Hello. I am using VMWare Horizon VDI with RADIUS 2-factor authentication. I need to change the RADIUS server to Microsoft NPS with NPX Extension for Azure AD MFA. Everything is working but for MFA I am getting with a text message with validation code or a Deny/Approve pop-up, depending on the default sing-in method other the user.

I want the user to get an one-time passcode in their Microsoft Authenticator App. Is there a way to change this on the NPS server?

We do have number-match enabled on our Azure tenant but that only work with 0365, not RADIUS.

Thanks

Answer 1

Yes, you can change the default sign-in method for MFA to the Microsoft Authenticator App on the NPS server. To do this, you'll need to configure the NPS server to use the Azure MFA NPS extension and then specify the desired authentication method in the RADIUS authentication policy. You can find detailed instructions on how to do this in the Microsoft documentation: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension.

Answer 2

Hello @Christian Carrasco !

Please follow the link here and read the following Note;

Regardless of the authentication protocol that's used (PAP, CHAP, or EAP), if your MFA method is text-based (SMS, mobile app verification code, or OATH hardware token) and requires the user to enter a code or text in the VPN client UI input field, the authentication might succeed. But any RADIUS attributes that are configured in the Network Access Policy are not forwarded to the RADIUS client (the Network Access Device, like the VPN gateway). As a result, the VPN client might have more access than you want it to have, or less access or no access.

As a workaround, you can run the CrpUsernameStuffing script to forward RADIUS attributes that are configured in the Network Access Policy and allow MFA when the user's authentication method requires the use of a One-Time Passcode (OTP), such as SMS, a Microsoft Authenticator passcode, or a hardware FOB.

So ithink this will be quite helpful!

If this answer helped you kindly mark it as Accepted and Up-Vote !

Otherwise we can discuss further details to help you as well

Best regards!