Active Directory Domain controller services(on prem) +SSO +MFA

Question

Hi

We have a local environment on win 2012 R2 which has ACtive directory domain services. I wanted to ask , which of these services support MFA
Does Active directory domain services/controller support MFA/SSO. Or Does any other existing service (without azure AD) on an on prem support MFA from below image

Answer 1

Not sure if what's you're looking for but...

If you are looking at ways to use MFA to open a session on a Windows 10 or 11 machines using more than just a password, there are three supported methods:

1. Smartcard (as suggested by @Philippe Levesque ). The user uses a PIN and its smartcard to open a session. It will require you to deploy a PKI and users will needs needs the smartcard as well as a physical reader attached to their device. It's a bit legacy but that sill works.
2. Windows Hello for Business, the user uses biometrics, and/or a PIN to open a session. Although there are ways to make it work for independently of Azure AD the recommended deployments will require the user to be synchronized in Azure AD and have an MFA method register on the account.
3. FIDO2, the user uses a FIDO key to open a session. Like for Windows Hello for Business, it will require the user to be synchronized in Azure AD.

Although it can be challenging to configure, you can set your account to log in only with those methods.

You can also protect On-Premises applications with Azure AD MFA. Again, assuming your identities are synched in Azure AD and have MFA. Using Azure AD Application Proxy, you can public application externally but also just integrate with Azure AD. Essentially your application becomes visible in Azure AD and you can trigger MFA based on Conditional Access Policies. That requires the users to use the correct URL to access the app though. And that's not MFA handled by the on-prem AD, it's MFA for the applications. So in that case AD doesn't know what's happening (unlike the 3 methods suggested above). But sometimes what you need is MFA when you access the data, so it might fit the bill.

If you are looking at ways to do MFA for VPN (or anything using RADIUS) you can use the Azure AD MFA Adapter for NPS. But now the recommendation is to integrate the VPN clients/servers directly with Azure AD (check the guide here and look for your remote access product) to get the MFA and other security features (such as Conditional Access Policies).

Then you have third-party products allowing you to integrate with Windows in different ways. I'll let the community chime in on those :)

Answer 2

Hi

From base only Azure AD support configuring MFA. On prem you can add a layer of security by adding smartcard authentification, but you can't out of the box use MFA. Some external service exist to offer your MFA for your on prem AD, but you must register to service like duo, or any other. (*I'am not affiliated with that service, but I stated it because it's a well know one)

Answer 3

Hi Team

Our requirement is our internal VM where application may or may not have internet but can talk to internal AD and AD system might have internet.
So we want to push SSO /MFA to ID provider that might be on AD DS on prem system or may be on same system and that will handle SSO with MFA.

I see application proxy will require our system to connect to cloud directly but is it possible that our on prem application can connect to SSO/MFA through our internal AD which may or may not talk to azure AD