MFA on Windows Logins for off site laptops

[DavR]

What's the current feeling about how to manage MFA on off site laptops? 

 

I'm putting together a batch of Windows 11 laptops for staff to borrow offsite. The model has been based around AAD joined devices only, Intune management, with the users Microsoft account for sign in plus MFA from Microsoft Authenticator. These will be shared devices, and I have 'Shared PC with OneDrive Sync' settings enabled.

 

We have MFA enabled for any offsite login, but, this doesn't seem to apply to Windows device logins. Instead, it logs onto the device with just a password, and SSO then breaks and prompts for MFA for other applications such as OneDrive.

 

Initially I thought password + MFA at the login box would be the best way to go, certainly it would be the conceptually easiest for our staff to understand, but the only way to do that seems to be by changing to Web Login provider. Windows Hello for Business wouldn't be the right product, as it's a per-device install, and we can't guarantee staff will be always using that device. I could relax MFA to not apply to these devices, on the logic that the laptop counts as "something you have", but that doesn't feel very secure IMO.

 

Any suggestions welcome!

[DavR]

Well, web log-in was a bust. 

 

Apart from being quite messy at the login screen, requiring the user to hit the sign in button twice before starting the actual sign in, and having last user remembered (ick, Shared Device remember), I couldn't quite get conditional MFA to cause a MFA prompt during the windows login, even though I had it on an external 4G connection, which should prompt MFA to kick in as it's outside of school IP range. So the end result was no different to a regular login, and still other apps are complaining they need MFA. There may be a way to hammer this until CA and login-based MFA work as I want, but ultimately it seems a very messy way of doing things.

 

I'm now looking at Windows Hello for Business. Hopefully, if I set it up right, this would be OK for long term users and fulfill the MFA requirement. I can't quite see a way to get casual users, ie, those who might borrow a laptop for a few days at a time and then return it, set up without dropping the MFA requirement in that scenario completely. It's far from ideal, but, increasingly looking like the least painful way. 

[MYK-IT]

Courtesy of Copilot 😉

 

Quote

 

Requiring Multi-Factor Authentication (MFA) for logging into an Azure AD-joined Windows 10/11 device when offsite (i.e., not on the corporate network) is a common security goal, but it's important to understand the current limitations and available workarounds:

🔒 Native Limitations

Microsoft does not currently support enforcing MFA at Windows sign-in (i.e., the local login screen) using Azure AD alone[1]. This is because:

• Windows login happens before the user is connected to the internet.
• Azure AD Conditional Access policies (which enforce MFA) only apply to cloud-based resources, not the local OS login.

✅ Recommended Workarounds

1. Use Windows Hello for Business (WHfB)

• WHfB provides two-factor authentication using a combination of:
  • Something you have (e.g., TPM chip or biometric device)
  • Something you know (PIN)
• It works offline and is Azure AD-integrated.
• You can configure it via Intune or Group Policy.

2. Use Conditional Access for Cloud Resources

• While you can't enforce MFA at Windows login, you can enforce it for:
  • Microsoft 365
  • Azure Portal
  • VPN access
• Use Conditional Access policies to require MFA when users are off-network or using untrusted locations.

3. Third-Party MFA Solutions

If you absolutely need MFA at the Windows login screen, consider third-party tools like:

• Duo Security
• Rublon MFA for Windows Logon and RDP [2] These tools integrate with the Windows login process and can enforce MFA even for offline or RDP logins.

---

🛠️ Suggested Setup for Your Case (Offsite MFA)

1. Join devices to Azure AD and enroll them in Intune.
2. Enable Windows Hello for Business via Intune.
3. Create Conditional Access policies to:
   • Require MFA for cloud apps when offsite.
   • Block access from non-compliant or unmanaged devices.
4. (Optional) Deploy a third-party MFA solution if you need MFA at the Windows login screen.

Would you like help setting up any of these steps in Intune or Conditional Access?

References

[1] Sanity check!: Prompt for AzureAD MFA during Windows 10 login (AD ...

[2] Enable MFA for Azure AD logins to Windows Logon and RDP

 

 

[DavR]

Ha! Thanks 😉

 

That's about where I'd got with it tbh. Web login sounded good on paper, but the reality was a bit messy. Windows Hello for Business is the supported solution, but, is not portable between devices, which is a problem in this scenario.

 

We already have MFA on all our cloud services, but, the prompts for this break SSO and the seamless startup of things like OneDrive client, which is a problem in the user experience.

[PotNoodleTech]

Can you do anything with FIDO security keys for just the windows login itself so at least you've got a physical device needed to act as a second factor?  I am saying this but no idea if it is possible in your scenario.  I love my Fido key.

[DavR]

1 hour ago, PotNoodleTech said:

Can you do anything with FIDO security keys for just the windows login itself so at least you've got a physical device needed to act as a second factor?  I am saying this but no idea if it is possible in your scenario.  I love my Fido key.

 

Hmmm, in theory that would be a portable user-based second factor, but would that not still require registration on each device? Or can you tie a FIDO2 key to a user account in Azure / Entra in a way that doesn't require that?

 

If it requires registration on each device, we might as well go with a WHfB PIN, the config overhead is very similar.

 

Outside of the theoretical though, there's no budget for hardware keys. What do you use yours for, @PotNoodleTech? Is it to replace traditional second factor, or do you go passwordless on certain devices?

[PotNoodleTech]

Yeh I thought it may not work for your scenario unless it can be forced to work. 

 

I use mine as an additional second factor I stil prefer to always use password and a second factor - it has proven very useful occasionally such as when my phone suddenly died and I lost that text message and ms authenticator in one fell swoop.  Could still get on with my Fido. I think all admins should have one as an emergency (that can also be used on the daily)  I've linked it in to everything even facebook etc etc.

[DavR]

You know, I could probably find the budget for ONE key, purely for R&D purposes.....! It's a thought.

[ITGuyNW]

Would Cisco Duo work?

 

You can have it installed on the laptop and add users into it as and when required? You can do up to 10 for free. 

[TwistedHelixis]

Quote

Microsoft does not currently support enforcing MFA at Windows sign-in (i.e., the local login screen) using Azure AD alone[1]. This is because:

• Windows login happens before the user is connected to the internet.
• Azure AD Conditional Access policies (which enforce MFA) only apply to cloud-based resources, not the local OS login.

 

And yet I can install Google Credential Provider onto a Windows devices and it will fully support all my users different 2 factor authentication methods, before letting them access Windows. Seems odd that MS cant support their own systems in the same way.

[DavR]

14 minutes ago, TwistedHelixis said:

Seems odd that MS cant support their own systems in the same way

 

Yeah, I honestly thought it would be a no-brainer - windows login box, followed by an MFA prompt, same as all their other services. But no, they had to go make it overly complicated (classic Microsoft, I suppose). I can see where they're going with WHfB, but that seems aimed at locking down the account, on the device, assuming a 1-to-1 device model, which we know in schools is rarely the case. What's wrong with at least having the option to tie it to the account?

[DavR]

27 minutes ago, ITGuyNW said:

Would Cisco Duo work?

 

You can have it installed on the laptop and add users into it as and when required? You can do up to 10 for free. 

 

Ooooh, it could be. I knew of Duo, and it might well do what we want, but wrote it off as an extra cost. I'd need about 20 licenses, but could I make 10 work, I wonder.

 

Thanks for the tip!

[psydii]

It perhaps wouldn't win the argument in an organisation that might be physically targeted by determined (financially/commercially motivated hackers), but I've taken the view that a school fully managed device is a *good enough* second factor (something you have) for most systems. HR /MIS / RDP /Entra etc all require a "third" factor (Authenticator usually).

[DavR]

I have been considering the mental gymnastics on that one. If, as I've seen written in a number of places, the TPM chip on your laptop counts as "something you have", then surely the laptop itself could be classed as something you have, also. But then I suppose the laptop itself isn't inherently a security device. 

 

For the sake of teachers doing their prep work or school reports, I am considering if I can get away the device itself being the second factor, as it's only on that device, in conjunction with a password, can you access your files. This would treat the staff laptop the same as we treat our onsite desktops, being exempt from "full" MFA via Conditional Access, whereas anything from a device on the wider Internet would required the full MFA challenge.

 

Not that anyone else here cares about security, so it's mainly convincing myself!