Remote Desktop Services & Azure MFA

[mikmeoli]

Hi,

 

I have Remote Desktop Services set up on server 2016 that is linked to Azure MFA through a NPS server and all works well. As i understand it all requests to logon when off site go through the gateway, on to the connection broker, then pass through the NPS going up to Azure for MFA authentication and then once approved allows the user to log in. If i wanted to allow certain users or security groups to bypass the MFA for whatever reason is there a way that can be achieved? I have set up a third session host (the other two being for all 'normal users') with different collection added to that host to the user in the particular group go to the correct host and see different remote apps etc.

 

Any suggestions would be great!

 

Thanks

[PyROm]

I havent done it for RDP/NPS before, but use it for email/application proxy. For these You can use conditional access rules in azure ad to only apply mfa for certain groups.

[mikmeoli]

Hi,

 

Thanks for the email. I already have conditional access that states only some user have mfa but that is for logging into office 365 or Azure and not for an RDP service. Currently if a user does not has MFA enabled on their account then they cannot access RDP at all which is what i want, but i also want to be able to select a small security group that can bypass MFA. Below are the authentication options i want but it is the last one i am stuck on as it seems that all traffic from the gateway goes via Azure MFA. (im also trying to avoid another gateway set up on a different external IP)

 

MFA enabled, In RDP security group = Access

MFA not enabled, In RDP security group = No Access

MFA not enabled, not in RDP group = No Access

MFA not enabled, in a special privileged security group = Access

[PyROm]

Could you create a new security group in you local ad server for people you dont want to use mfa for rdp but do want to give access to rdp. Then create a new policy on your local nps server so that it processes members of the new group (set under constraints) locally rather sending the request off to azure? You might need to exclude the group from the azure policy to ensure that it only auths with you non-azure one.

[mikmeoli]

I have done that and it seems to have worked although i have set up a connection request policy for each and under conditions selected the user as you cant seem to do it by security group.