Azure MFA with On-Premise RDP

[HereIGoAgain2601]

Hi,

 

Does anyone know how to get Azure MFA working with an on prem RD gateway?

 

I found some guides but ended up breaking the server and had to restore from a backup!

 

I ended up with an Azure app proxy and you got prompted for MFA.

 

This then let you logon to the RD web bit of the server but whenever you tried to get onto an RD session it didn't load.

 

Ended up having to restore a backup so people could get on!

 

Thanks

[robyholmes]

We have it working and one thing it doesn't make clear is you can't use text code or app code for RDP. As it doesn't give you a chance to enter it. You need to use phone call or approval via app.

[free780]

I think it is in MS docs as you can use it with anything that uses radius. You need a dedicated NPS Server for it. Or use the app proxy with the RDS web client.

[altriox]

We set ours up back in April.

 

 

The gotchas that got us was making sure that the Load Balancing settings matched on the NPS on the Remote Desktop Gateway, and on the RAS/NPS server.

 

You can validated this by opening up the NPS (on both servers):

- Under RADIUS Clients and Servers -> Remote RADIUS Server.

- Right-click the Group Name, click Properties

- Edit the RADIUS Server

- On the Load Balancing Tab; Advanced settings

- Number of seconds between response. . . = 60

- Maximum number of dropped requests. . . = 5

- Number of seconds between requests. . . = 60

 

If these aren't set properly, then the RDGW and/or the RAS will timeout. If the user takes too long to approve the MFA notification or phone call, it'll also timeout.

 

If any users are using the phone call option, make sure you turn off or lower the reconnect option on the RDP client. We had users complaining about getting calls in the middle night from Microsoft because they'd leave their RDP connection and it disconnected.

Edited December 16, 2020 by altriox

[free780]

Gets even more fun with multiple NPS Servers. You basically have to have riles that makes sure the same NPS Server handles the authentication if you have multiple. It's best to you Powershell to export the config and import.

[tech-man]

We use ESET Secure Authentication. Setup and running very quickly.

[HereIGoAgain2601]

Hello,

 

I'm back to looking at this again and can't for the life of me get it to work. I've followed various guides and seem to get so far and everything looks OK - but then nothing happens.

 

Are there any edugeekers out there that could help point me in the right direction? We want to use the Azure MFA as we already have this setup and licensed.

 

I've tried using an Enterprise App and then following another guide regards installing an NPS extension and neither seem to work properly.

 

Thanks

[robyholmes]

Hello,

 

I'm back to looking at this again and can't for the life of me get it to work. I've followed various guides and seem to get so far and everything looks OK - but then nothing happens.

 

Are there any edugeekers out there that could help point me in the right direction? We want to use the Azure MFA as we already have this setup and licensed.

 

I've tried using an Enterprise App and then following another guide regards installing an NPS extension and neither seem to work properly.

 

Thanks

 

Are you following this guide?

https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension-rdg

[HereIGoAgain2601]

Yeah I tried this one and everything seemed to be right but no Mfa prompts came through. Looked at the error logs on MFA logs on the NPS server and that saw me logging in but didn’t challenge me or pass anything back to the RD gateway. Going to build a new environment today and try again as need to update from server 2016 anyway. Thanks

[free780]

There are some domains that may need whitelisting from the NPS server.

 

Also check

 

Azure AD > Security > MFA > Activity Report