1,922 questions
Hi, And there is any solution?
Windows VPN with MFA
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(99.2, 11%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ENG%3C/text%3E%3C/svg%3E)
Nuno Galego
6
Reputation points
Hi I have a problem with my VPN.
I create a VPN in Windows Server and a NPS to autenticate users.
I also have a MFA setup and works. The problem is that VPN only work with Authenticator, and dont work with SMS token.
A receive a message with a PIN, but dont have a place to put..
Anyone can help??
Windows for business Windows Server Devices and deployment Configure application groups
{count} vote
-
JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator2020-12-22T00:26:01.073+00:00 anonymous user-8631
Thank you for your post!- Have you tried navigating your "aka.ms/mfasetup" and changing your MFA preference?
- Can you share the documentation that you followed to set up MFA on your Windows server?
- Are you able to provide some screenshots of what you're seeing so I can gain a better understanding of your issue?
Any additional information would be greatly appreciated.
If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue. -
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Anonymous2020-12-22T04:27:28.263+00:00 Your question is more related with MFA part, we will remove windows-server-windows-server-security tag. Thank you!
-
Nuno Galego 6 Reputation points
2020-12-22T09:48:46.943+00:00 Hi, yes I already change in aka.ms my preference.
The situation is that this only work with microsoft autentication on the phone. Who dont have this installed, dont enter on the VPN.
The tuturial that I fallow is this:
https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension-vpn
Can you help me?
-
JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator
2020-12-22T23:32:42.343+00:00 anonymous user-8631
Thank you for the quick response!It sounds like your MFA set up works, but the main problem is that the VPN setup only works with the Authenticator app, and not with an SMS token?
Have you looked into any of the below troubleshooting guides?
Troubleshooting RADIUS
Troubleshooting guideI also reached out to my team regarding this and since this process requires a lot of NPS/on-prem AD configuration, I've added the "windows-active-directory" tag to this thread so their community can take a look into this issue as well.
Thank you for your time and patience throughout this issue.
-
Nuno Galego 6 Reputation points
2020-12-23T12:12:47.913+00:00 Yes, thats it! VPN works, but only wirh the Authenticator App, not with SMS token.
If I unnistall app, I receive a SMS token, but I havent a place to put it. So I cant log into VPN without Authenticator App,
I receive a SMS token, but there is no Popup to insert that..
Please help...
-
Nuno Galego 6 Reputation points
2020-12-23T17:07:54.167+00:00 Yes, I already look into this troubleshooting sites.
It works, but onlu with AUthenticator App... If I dont have this aplication I receive a SMS with a token, but I dont have a place to insert this...
Only works with authenticator..
Please help me!
-
JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator
2020-12-23T18:40:47.637+00:00 anonymous user-8631
Thank you for the quick response and confirmation!From the Auth flow I see that you can use phone call, text message, or mobile app, but if there's no place to type in the SMS verification code, I believe this has the potential to be a by design issue.
Later in the documentation the Authenticator App is also used.
I've reached out to our engineering teams regarding this issue and will update as soon as possible.
Thank you for your time and patience throughout this issue.
-
Nuno Galego 6 Reputation points
2020-12-24T16:12:49.507+00:00 The problem is that there is no place to choose if this authenticates from App or via SMS.
~ -
Al Schneiter 6 Reputation points MVP2020-12-27T16:43:08.96+00:00 Hi anonymous user-8631
As far as I know, Microsoft CHAP Version 2 and EAP only supports phone call or mobile app notification. I found a threat regarding this:The same is valid for RD Gateway:
Supported methods are: Phone call, Authenticator app with notification.
Unsupported methods are: SMS, Authenticator app with PIN.
https://learn.microsoft.com/en-us/answers/questions/44596/azure-mfa-nps-extension-rds-gatway-method.htmlCheers, Al
-
Nuno Galego 6 Reputation points
2020-12-28T09:57:55.763+00:00 Hi, and there is any solution for this??
-
Nuno Galego 6 Reputation points
2020-12-28T11:18:00.253+00:00 In this article said that If I change my radius to PAP, it will work, but I already changed,and nothing new happen... This is the same.. only work with the App. If I unistall the App dont work...
Sign in to comment
4 answers
Sort by: Most helpful
-
Nuno Galego 6 Reputation points
2020-12-28T10:00:46.667+00:00 -
JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator
2020-12-28T17:20:05.47+00:00 anonymous user-8631
I've enabled your subscription for a one-time free technical support request so our support engineers can take a closer look into this issue. Once you arrive at a solution/workaround, please feel free to update your thread with the answer so others from the community who're experiencing a similar issue can easily find the solution.Thank you for your time and patience throughout this issue!
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(201.6, 27%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELD%3C/text%3E%3C/svg%3E)
Luc Duong 36 Reputation points2021-04-12T02:41:38.41+00:00 anonymous user-8631
Hi, Have you found a solution to this problem?
Sign in to comment -
-
Nuno Galego 6 Reputation points
2021-04-12T08:23:10.347+00:00 NO, there is no solution. SMS dont work at all in windows VPN
-
Luc Duong 36 Reputation points
2021-04-12T09:24:47.887+00:00 I have the same problem in the case of using TOTP, and I have no solution either.
Sign in to comment -
-
Nuno Galego 6 Reputation points
2021-04-12T09:29:06.707+00:00 No Solution, this only work with Authenticator.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(307.2, 26%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAW%3C/text%3E%3C/svg%3E)
Adam Wiernicki 1 Reputation point2022-05-13T14:46:11.587+00:00 Hi, @JamesTran-MSFT , are you going to resolve this problem soon?
It works perfectly with Office 365, but not with VPN. It should work the same...
I get a code in SMS but there is no place to put it in.Best regards