25,080 questions
If you are referring to an on-prem hosted site, you would probably want to go with the Azure AD Application Proxy.
https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy
MFA For Website Access
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(240, 34%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKP%3C/text%3E%3C/svg%3E)
Kumaran Palayathan
1
Reputation point
Hi,
I would like to setup MFA authentication for users accessing my site on the internet. Is there a way to do that using Azure and Microsoft Authenticator?
An example scenario would be as below.
User opens the web portal (e.g. https://somesite.com) > user is requested for user name and password and an MFA authentication is sent to their phone to approve the login > User is then able to view the site contents.
How can I achieve this?
Thank you in advance.
Microsoft Security | Microsoft Entra | Microsoft Entra ID
{count} votes
-
risolis 8,741 Reputation points2022-03-12T21:39:25.77+00:00 -
Kumaran Palayathan 1 Reputation point
2022-03-14T16:14:01.64+00:00 Hi,
I am not familiar with SAML. Furthermore I'm looking for a solution for my organization which already has an Azure AD subscription.
So I think it would be easier to setup an MFA with Azure but I'm just not sure how to achieve what I want in the above scenario.
Thank you for your suggestion. However I would be interested in reading up on SAML if you could point me in the right direction.
Regards.
Sign in to comment
1 answer
Sort by: Most helpful
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(131.20000000000002, 80%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3END%3C/text%3E%3C/svg%3E)
Nate Duperon 6 Reputation points2022-03-14T16:36:02.33+00:00 -
Kumaran Palayathan 1 Reputation point
2022-03-15T14:33:19.38+00:00 Hi NateDuperon,
I think the application proxy could be the way to go. Does it require the on-prem AD as the diagram indicates?
My environment is all Linux and no Windows. The interactive applications are all Linux based. I suppose I could setup a Windows server to run the application proxy in the internal network.
If the the users can reach the web portal from the internet I think they can login to the site with their local Linux account and run the applications.
I suppose the user accounts can be setup in the Azure AD for initial authentication and MFA login approval then the request is sent to the application proxy and the web portal is displayed afterwards.
Please advise.
Thank you.
-
Nate Duperon 6 Reputation points
2022-03-15T15:27:29.797+00:00 You do need local AD joined machines for KCD SSO but, for just MFA pre auth, you should only need a Windows server running the connector(proxy). Refer to this article for more info:
https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-deployment-plan
Sign in to comment -