How to enable multi-factor authentication for rdp connections

Question

Hi, I need to set up a multi-factor authentication system for rdp connections to my windows server 2016. I have been looking at all the guides out there on this. I have it configured with microsoft authenticator for a group of users accessing the azure portal, but I do not know how to move this to the rdp connections as all the guides tell me that it is done with a multifactor authentication server that can no longer be downloaded or by nps, it would be nice to do it by nps but while I configure it I see that only has two methods, or password or smart card, I want to do it to ask for authentication by sms or microsoft authenticator.
Any solution for this?
Greetings and thanks in advance

Answer 1

Hi @RsysMartem • Thank you for reaching out.

You can achieve these requirements by using Azure AD MFA Service, which is different from Azure MFA Server. Now you don't need to install the MFA Server software on any of your servers and can directly use the Azure MFA Service to trigger MFA when RDPing to your Windows machines, with the help of NPS Extension. The purpose of the NPS extension is to translate the NPS RADIUS calls to REST (HTTPS) calls that Azure AD supports and directly leverage the Azure AD MFA, without needing to have on-prem MFA server.

Below are the prerequisites:

• Remote Desktop Gateway
• Azure AD MFA License
• NPS Server with NPS Extension installed
• Azure Active Directory synched with on-premises Active Directory

Once the above prerequisites are checked, you can follow Integrate your Remote Desktop Gateway infrastructure using the Network Policy Server (NPS) extension and Azure AD for step-by-step instructions.

Note: The MFA method that you choose must not require users to input any type of code/OTP for 2nd factor of authentication as the Remote Desktop Connection doesn't provide you with an option to enter a code. So, you must choose Phone Call or Authenticator App notification (not Authenticator App with Code) and the SMS method won't work in this case.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Hi @RsysMartem

Thank you for asking this question on the **Microsoft Q&A Platform. **

There is no direct way to activate MFA for RDP Connection.

You should make some huge changes to your infrastructure to achieve that.

Share two links that can help with that:

**- Remote Desktop Gateway and Azure Multi-Factor Authentication Server using RADIUS

• Integrate your Remote Desktop Gateway infrastructure using the Network Policy Server (NPS) extension and Azure AD**

However,

If what you are looking for is more security for your RDP Connections, you can implement the following solutions:

**- Remote Desktop Service

• Jump Server
• just-in-time access
• Azure Bastion**

As you can see, you have some substitutive security controls that can help you secure your RDP connection.

Hope this helps, Carlos Solís Salazar

Accept Answer and Upvote, if any of the above helped, this thread can help others in the community looking for remediation for similar issues.

NOTE: To answer you as quickly as possible, please mention me in your reply.

---

Answer 3

Hi, thanks for your quick reply.

I suppose that remote dekstop gateway is installed with the remote desktop services deploying resource, I have a problem for this, when assigning VM sizes, it tells me that there is none available and therefore does not let me create it.
Is this because of the type of subscription? Mine is level 1, should I upgrade to 2?

Answer 4

Thanks @AmanpreetSingh-MSFT and @Carlos Solís Salazar , I'll have a look at these links to see if they give me a solution.

Answer 5

@RsysMartem

The availability of VM Size will depend on the region where you are deploying the VMs.

Hope this helps,
Carlos Solís Salazar

----------

Accept Answer and Upvote, if any of the above helped, this thread can help others in the community looking for remediation for similar issues.

NOTE: To answer you as quickly as possible, please mention me in your reply.

---