MFA NPS extension > disabling push notification

Question

Dear,

We've rolled out MFA NPS extension for our VPN solution.

Several users are MFA registrered in Office365 with push notification via MS authenticator app.

We wan't to get rid of the push notification and we want to disable it via Azure AD.

What happens with our NPS VPN users in this case?

It seems that however we disabled push notification, users who have registrered in the past for push notification can still authenticate via push for the VPN.

Is this by design? I expected that once we disabled push notification, no one in the organisation should be able to use push anymore, but this seems to affect only new registrations for mFA?

Any ideas?

Answer 1

Hi @Anonymous ,

It sounds like your best bet would be to enable OTP enforced by number matching to override the Approve/Deny options in push notifications and require an OTP instead.

In order to do this, you need to make sure that the registry key OVERRIDE_NUMBER_MATCHING_WITH_OTP Value = TRUE is set to "TRUE" on the NPS server.

This will only work on NPS extension version 1.0.1.40 or later, and only for users who have Authenticator registered as an authentication method. Additional limitations around this setting are noted in How to MFA Number Match .

Let me know if this meets your requirements and if you have further questions.

If the information helped you, please Accept the answer. This will help us as well as others in the community who might be researching similar information.