Azure AD NPS Extension - License Confusion

Question

Azure AD NPS Extension - License Confusion

Jake Bloomfield 26

Hi,

I'm trying to implement the Azure MFA NPS extension to allow our on-prem VPN to use Azure AD MFA - using this guide: https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension

I am confused as to what license(s) I need for this to work. Our tenant currently uses Office 365 E3 subsciptions, and I can see in the Azure Portal that the license is "Azure AD Premium P1".

When going through the PowerShell portion of the setup, I was getting the following error: "New-MsolServicePrincipal -AppPrincipalId..."

Can I get some clarification?

Thanks

ShashiShailaj-MSFT 7,431 Reputation points Microsoft Employee

2022-01-24T10:55:30.89+00:00

@Jake Bloomfield ,
You require Azure AD Premium P1 in order to use use the Azure MFA Extension . If on the Azure AD portal you see Azure AD premium P1 then you already have AAD premium P1 license by virtue of any existing license. What is the error you are getting? Could you please provide the error message in detail so that we can help further on this.
Jake Bloomfield 26 Reputation points

2022-01-24T22:56:41.427+00:00
Hi @ShashiShailaj-MSFT ,

Thanks for your reply - much appreciated.

I get the following error, just after I enter the tenant ID:

New-MsolServicePrincipalCredential : Service principal was not found.
At C:\Program Files\Microsoft\AzureMfa\Config\AzureMfaNpsExtnConfigSetup.ps1:67 char:1

New-MsolServicePrincipalCredential -AppPrincipalId $appPrincipalId -T ...

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

CategoryInfo : OperationStopped: (:) [New-MsolServicePrincipalCredential], MicrosoftOnlineException

FullyQualifiedErrorId : > Microsoft.Online.Administration.Automation.ServicePrincipalNotFoundException,Microsoft.Online.Administration.Automation.NewServicePrincipalCredential
Jake Bloomfield 26 Reputation points

2022-01-24T23:05:14.447+00:00

Here is a screenshot of the issue: https://i.imgur.com/YEj72Qz.png - the image upload feature wasn't working for me. I hope the link is acceptable.
Jake Bloomfield 26 Reputation points

2022-02-01T21:19:20.433+00:00

Can anyone help me with this?

ShashiShailaj-MSFT 7,431 Reputation points Microsoft Employee

2022-01-24T10:55:30.89+00:00

@Jake Bloomfield ,
You require Azure AD Premium P1 in order to use use the Azure MFA Extension . If on the Azure AD portal you see Azure AD premium P1 then you already have AAD premium P1 license by virtue of any existing license. What is the error you are getting? Could you please provide the error message in detail so that we can help further on this.
Jake Bloomfield 26 Reputation points

2022-01-24T22:56:41.427+00:00

Hi @ShashiShailaj-MSFT ,

Thanks for your reply - much appreciated.

I get the following error, just after I enter the tenant ID:

New-MsolServicePrincipalCredential : Service principal was not found.
At C:\Program Files\Microsoft\AzureMfa\Config\AzureMfaNpsExtnConfigSetup.ps1:67 char:1

New-MsolServicePrincipalCredential -AppPrincipalId $appPrincipalId -T ...

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

CategoryInfo : OperationStopped: (:) [New-MsolServicePrincipalCredential], MicrosoftOnlineException

FullyQualifiedErrorId : > Microsoft.Online.Administration.Automation.ServicePrincipalNotFoundException,Microsoft.Online.Administration.Automation.NewServicePrincipalCredential
Jake Bloomfield 26 Reputation points

2022-01-24T23:05:14.447+00:00

Here is a screenshot of the issue: https://i.imgur.com/YEj72Qz.png - the image upload feature wasn't working for me. I hope the link is acceptable.
Jake Bloomfield 26 Reputation points

2022-02-01T21:19:20.433+00:00

Can anyone help me with this?

Answer 1

ShashiShailaj-MSFT 7,431 Microsoft Employee

@Jake Bloomfield , Apologies for the delay on this. I checked on this and found that this can occur if you do not have "Azure Multi-Factor Auth Client" application registered within your tenant . This is a first party application provided from Microsoft but sometime due to transient issues it may not be present in a tenant . In order to check the same , you can use the following powershell cmdlet .
Connect-MsolService
Get-MsolServicePrincipal -AppPrincipalId 981f26a1-7f43-403b-a875-f8b09b8cd720

Or you can check the same from the portal as shown in the picture.

Go to https://aad.portal.azure.com > "Enterprise Applications" > Search for "Azure Multi-Factor Auth Client" > Check properties for this app > Confirm if the service principal is enabled or disabled > Click on the application entry > Go to Properties of the app > If the option "Enabled for users to sign-in? is set to No in Properties of this app , please set it to Yes.

If this app is not present , Please try to run the following cmdlet using a global admin credentials on the Azure AD powershell prompt .

Connect-MsolService
New-msolServicePrincipal -AppPrincipalId 981f26a1-7f43-403b-a875-f8b09b8cd720 -DisplayName "Azure Multi-Factor Auth Client"

Now run \AzureMfaNpsExtnConfigSetup.ps1 .

This should work.

Regards,
Shashi

Jake Bloomfield 26 Reputation points

2022-02-03T10:26:02.41+00:00

Hi @ShashiShailaj-MSFT ,

I can confirm your steps worked. I had to manually add the enterprise app via PowerShell. Now I have set up the Azure AD NPS extension and MFA works with the third-party sign-in.

I really appreciate your help - May I suggest this fix and info is added to the official MS documentation to help others.

Many thanks,
Jake
ShashiShailaj-MSFT 7,431 Reputation points Microsoft Employee

2022-02-03T11:45:42.97+00:00

@Jake Bloomfield , I am glad that your issue is fixed. Let me see how best we can incorporate this in the documentation and I will update you on the same. Please allow me some time on this . I have converted this post to an answer. Could you please accept this post as answer by clicking on so that it can be beneficial to others in the community searching for similar solutions.
ShashiShailaj-MSFT 7,431 Reputation points Microsoft Employee

2022-03-28T11:04:26.227+00:00

@Jake Bloomfield , We have updated this to the troubleshooting section on the article https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension for anyone who may be searching for similar error.

Thank you .

Azure AD NPS Extension - License Confusion

0 additional answers

Activity