How to enable MFA (via DUO) for AAD joined Windows devices

Question

We are attempting to enable MFA for Windows logins for devices that are AAD joined (not hybrid). Ultimately we would like to use Duo as our MFA provider, and I've followed their instructions for setup located here.

https://duo.com/docs/azure-ca

We have conditional access setup, and it works great when we join a device to AAD, but can't get it to come up when a user logs into a laptop. Is there a specific CA policy that can be used that includes Windows Sign In?

Answer 1

Hi

the DUO control you have installed above is more to do with conditional access to applications in the same way as native Azure MFA would work with Authenticator.

MS does not allow any Azure MFA at the time of Windows login, so you would need a 3rd party tool. From a DUO perspective you could use the RDP/Console MFA offering to make this work:

https://duo.com/docs/rdp

You should already be licensed for this with your existing DUO subscription.

Hope this helps,

Thanks

Michael Durkan

• If the reply was helpful please upvote and/or accept as answer as this helps others in the community with similar questions. Thanks!