Only allow MFA connection to RDP server

Mitch 1

I've set up our Remote Desktop server to allow access by using Multi Factor Authentication through the Microsoft Authenticator app by using this guide.

This works for all new connections through the rd web access site, users must authenticate with the app before it allows them remote into the server. But for people who have created their own RDP shortcuts, with the "Automatically detect RD Gateway server settings" option selected, can bypass MFA and connect with just their username and password.

Is there a way to restrict connection so that users must use MFA to connect?

Marilee Turscak-MSFT 33,801 Reputation points Microsoft Employee

2021-10-04T20:46:58.04+00:00

I would think that even if they have that setting enabled, you could use a conditional access policy to enforce the MFA anyway. I've reached out to the product team to confirm though.
Marilee Turscak-MSFT 33,801 Reputation points Microsoft Employee

2021-10-15T18:25:28.39+00:00

I'm not aware that a setting in the RDP file will keep MFA from happening. I am wondering if there is already a MFA token and that is why they are not getting prompted? It is difficult to say since we don't have any diagnostic logging available to us.
Mitch Jaehlrich 1 Reputation point

2021-10-25T14:44:08.053+00:00

If a user creates a new remote desktop connection and specifies to automatically detect gateway settings, it will still let them connection without MFA. If they specify the gateway address, it prompts for MFA.

So far I've been working around the issue by blocking the non-MFA connection at the firewall level, but I figure there must be a setting to accomplish this as well.

1 answer

Pieter van Kampen 1 Reputation point

2021-10-29T19:50:43.007+00:00

Are you sure? I think MFA does not work when you login to an existing (disconnected) session, it only works when you login to a computer where the user previously logged out. Can you try that?

How do you block the non-MFA connection at the firewall level?
Please sign in to rate this answer.

0 comments No comments
Sign in to comment