NPS extension for Azure MFA and Meraki Radius WIFI

Question

Hi,

I need some assistance with getting the extension to work. Sometimes i receive a success auth via the NPS logs, but never connect to WIFI via Meraki Radius.

Occasionally i see this: NPS Extension for Azure MFA: CID: de4ec0e0-a072-4bd5-8369-18d735d9706e : Challenge requested in Authentication Ext for User MFSLAW\khf with state 21011523-2e5a-4a6c-ac10-05b313a112f8

More often this:

NPS Extension for Azure MFA: NPS Extension for Azure MFA only performs Secondary Auth for Radius requests in AccessAccept State. Request received for User khf with response state AccessChallenge, ignoring request.

I've run the NPS health scipt and with MFA cut off, NPS processes logins fine. Attached is output of health check script complaining about license which the account has AD P1, and SAMACCCOUNTNAME this is probably due to using *.onmicrosoft.com domain. MFA processes fine on this user account.

Attached is also the output from the health check script. I've had a ticket open with Microsoft for a week or more with no response. I'd greatly appreciate any help.

Log files located here: https://netsouthrqna-my.sharepoint.com/:f:/g/personal/ccrawford_networksouth_com/Ena-OPxkst5Epda7_jgSDdABQjboEbo_hW1W269TWC6z5w?e=wqcwmR

Windows Server 2019 with NPS installed in Azure

Meraki MX85 with WIFI Radius ebabled, working with MFA (no extension for azure)

Thanks!

Answer 1

@Cameron Crawford

Thank you for posting your query on Microsoft Q&A, from above description I could understand that user is not getting an MFA prompt but denied message while trying connect to WIFI using NPS extension.

Please do correct me if this is not the case by responding in the comments

As per NPS Extension Errors error message above is displayed under following condition:

This response is used when additional information is required from the user to complete the authentication or authorization process. The NPS server sends a challenge to the user, requesting further credentials or information. It usually precedes an Access-Accept or Access-Reject response.

Although NPS doesn't support number matching, the latest NPS extension does support time-based one-time password (TOTP) methods such as the TOTP available in Authenticator, other software tokens, and hardware FOBs. TOTP sign-in provides better security than the alternative Approve/Deny experience. Make sure you run the latest version of the NPS extension.

Anyone who performs a RADIUS connection with NPS extension version 1.2.2216.1 or later is prompted to sign in with a TOTP method instead of Approve/Deny. Users must have a TOTP authentication method registered to see this behavior. Without a TOTP method registered, users continue to see Approve/Deny.

Suggestion:

• Kindly validate the NPS extension version, if running *1.2.2216.1 then ensure that TOTP authentication method *is registered and Microsoft Authenticator registered as an authentication method
• If running any of the earlier versions then you need to modify the registry to require users to enter a TOTP: 1.2.2131.2 1.2.1959.1 1.2.1916.2 1.1.1892.2 1.0.1850.1 1.0.1.41 1.0.1.40

To create the registry entry to override the Approve/Deny options in push notifications and require a TOTP instead:

• On the NPS Server, open the Registry Editor.
• Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AzureMfa.
• Create the following String/Value pair: undefinedundefined
• Restart the NPS Service.

In addition:

undefined> The NPS Server where the NPS extension is installed must be configured to use PAP protocol. For more information, see Determine which authentication methods your users can use.

undefinedundefinedMSCHAPv2 doesn't support TOTP. If the NPS Server isn't configured to use PAP, user authorization fails with events in the AuthZOptCh log of the NPS Extension server in Event Viewer:

NPS Extension for Azure MFA: Challenge requested in Authentication Ext for User npstesting_ap. You can configure the NPS Server to support PAP. If PAP is not an option, you can set OVERRIDE_NUMBER_MATCHING_WITH_OTP = FALSE to fall back to Approve/Deny push notifications.

• If your organization uses Remote Desktop Gateway and the user is registered for a TOTP code along with Authenticator push notifications, the user can't meet the Microsoft Entra multifactor authentication challenge and Remote Desktop Gateway sign-in fails. In this case, you can set OVERRIDE_NUMBER_MATCHING_WITH_OTP = FALSE to fall back to Approve/Deny push notifications with Authenticator.

undefinedThanks,

Akshay Kaushik

undefinedPlease "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.