Microsoft Security | Microsoft Entra | Microsoft Entra ID
A cloud-based identity and access management service for securing user authentication and resource access
Implementing Intra Id MFA authentication for Inpremises vpn server
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(192, 76%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVK%3C/text%3E%3C/svg%3E)
Vikas Kawade
0
Reputation points
We have the Microsoft vpn server role configured on server 2022.
We would like the user to access the vpn using Microsoft ID and MFA.
Need to have a setup procedure
.
Microsoft Security | Microsoft Entra | Microsoft Entra ID
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(201.6, 99%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ER%3C/text%3E%3C/svg%3E)
Rukmini 8,335 Reputation points Microsoft External Staff Moderator2025-12-04T22:50:38.2133333+00:00 Hello Vikas Kawade,
It sounds like you're trying to set up Microsoft Entra ID for Multi-Factor Authentication (MFA) on your Windows Server 2022 VPN. Here's a general outline of how you can go about doing that:
Steps to Implement Intra ID MFA for On-Premises VPN:
- Prerequisites:
- Ensure you have the Network Policy and Access Services (NPS) role installed.
- Verify that you have a Microsoft Entra ID subscription with MFA capabilities.
- Make sure your Microsoft Entra ID is synced with your on-premises Active Directory.
- Install the NPS Extension for Microsoft Entra MFA:
- Install the NPS Extension for Microsoft Entra Authentication which allows NPS to integrate with Microsoft Entra ID for MFA.
- Follow the steps in the NPS Extension documentation to get this set up.
- Configure the NPS:
- Open the Network Policy Server console and create a new RADIUS client. This client will represent your VPN server.
- Make sure to configure authentication to forward requests to Microsoft Entra for MFA.
- Set Up Conditional Access Policies:
- Go to the Microsoft Entra admin center.
- Navigate to Protection > Security Center > Conditional Access to create a new policy specifically for the VPN access.
- Include the users that should be required to use MFA.
- Configure VPN Client:
- On your VPN client configuration, ensure it is set to contact the NPS server for authentication requests.
- Test the VPN connection to verify that users are being prompted for MFA as expected.
Resources:
- Configure Microsoft Entra multifactor authentication capabilities using NPS
- Configure the Microsoft Entra multifactor authentication NPS extension
- VPN with Microsoft Entra multifactor authentication using the NPS extension
I hope this helps you get started on setting up MFA for your VPN users! If you need more detailed steps on any part of the process or if you have specific configurations in mind, let me know!
Follow-Up Questions:
- Have you installed the NPS role on a server that is separate from your VPN server?
- Is your Microsoft Entra ID already synced with your on-premises Active Directory?
- Are you experiencing any specific errors during the setup process that you need assistance with?
- What type of VPN server setup are you using (e.g., Routing and Remote Access Service - RRAS, etc.)?
- Prerequisites:
Sign in to comment
Sign in to answer