Using existing NPS with MFA on new RDS server

[Sheridan]

I'm just testing something and getting nowhere so I thought I'd do a sanity check with fellow Geeksters

 

We currently have an old VPN that authenticates via an internal Radius server. That radius server has the Azure MFA component and it works fine. VPN users connect and authenticate and then respond the the MFA prompt on their phone

 

What I'm planning to to do is implement an RDS server - and set it to authenticate using the existing Radius (with Azure MFA) server - so when a user logs in to the RDS server they login and authenticate via MFA 

 

I've setup a RDS server and set the RD Gateway Server RD-CAP to be the existing Radius/MFA server and set NPS on the RDS server to use the existing NPS server as a remote Radius server. However I'm either missing something trying something that isn't possible as when I test the connection it logs in without and MFA, and the Radius server with MFA shows no authentication requests so it must still be going through NPS on the RDS server

 

Is this possible? Or do I need to setup a different way to use Radius with Azure MFA for the RDS server?

[steveg]

Would this not be easier with Azure app proxy?  

[Davit2005]

Have you seen this, suggests it is possible

 

https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-nps-extension-rdg

 

Quote

When the NPS extension for Azure is integrated with the NPS and Remote Desktop Gateway, the successful authentication flow is as follows:

1. The Remote Desktop Gateway server receives an authentication request from a remote desktop user to connect to a resource, such as a Remote Desktop session. Acting as a RADIUS client, the Remote Desktop Gateway server converts the request to a RADIUS Access-Request message and sends the message to the RADIUS (NPS) server where the NPS extension is installed.
2. The username and password combination is verified in Active Directory and the user is authenticated.
3. If all the conditions as specified in the NPS Connection Request and the Network Policies are met (for example, time of day or group membership restrictions), the NPS extension triggers a request for secondary authentication with Microsoft Entra multifactor authentication.
4. Microsoft Entra multifactor authentication communicates with Microsoft Entra ID, retrieves the user's details, and performs the secondary authentication using supported methods.
5. Upon success of the MFA challenge, Microsoft Entra multifactor authentication communicates the result to the NPS extension.
6. The NPS server, where the extension is installed, sends a RADIUS Access-Accept message for the RD CAP policy to the Remote Desktop Gateway server.
7. The user is granted access to the requested network resource through the RD Gateway.

 

Use wireshark on both NPS and RDG if possible to see if request is sent by RDG and received by NPS server

Edited September 4, 2025 by Davit2005

[jnfarmer]

We're moving away from the RDS with MFA set up. MFA flow is so slow when it does work.

 

We're moving to Palo Alto's Global Protect VPN, using M365 to authenticate so user's still use MFA.

[Sheridan]

Hmm, I wonder if I should just add the Azure extension for NPS on the RDS server - this is really only a test as we only need the RDS server for maybe a year or so!

[Davit2005]

42 minutes ago, Sheridan said:

Hmm, I wonder if I should just add the Azure extension for NPS on the RDS server - this is really only a test as we only need the RDS server for maybe a year or so!

Would it not need to be installed on the NPS server? We used to use a MFA plug in for our MFA but we gave up. We now jus use SAML for Global Protect VPN, setup is a breeze.

Edited September 4, 2025 by Davit2005

[StephenPink]

Yeah I use this at one site. The MFA extension is on the NPS server not the RDS Server - but I had to spin up new NPS servers specifically for this, as the MFA extension has very little control so just takes over ALL the NPS policies on that server. 

Could be a timeout issue;

 

Configure RADIUS timeout on the Remote Desktop Gateway NPS

 

In order to ensure that there is time to validate credentials, and respond to MFA prompt, the default RADIUS timeout needs to be changed

 

From RDS SERVER

• Network Policy Server > RADIUS Clients and Servers > Remote RADIUS Server > TS GATEWAY SERVER GROUP
• Select each NPS Server
  • Edit > Load Balancing
  • Number of seconds without response before request is considered dropped > 60
  • Number of seconds between requests when server is identified as unavailable > 60

[Sheridan]

Thanks, I'm going to add another Radius server and add the MFA extension and use that - at least it keeps things seperate and leaves the working vpn setup alone (which I can remove when this is working!)

[StephenPink]

10 minutes ago, Sheridan said:

Thanks, I'm going to add another Radius server and add the MFA extension and use that - at least it keeps things seperate and leaves the working vpn setup alone (which I can remove when this is working!)

If it already has the extension on it then it should be fine I would think. I followed the guidance from Microsoft here: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension-rdg when setting up, but can share my own if useful?

It gets a little confusing as RDS kind of has its own built in NPS as well - that you need to disable parts of/forward other bits to the NPS server with the extension on.

[Sheridan]

40 minutes ago, StephenPink said:

If it already has the extension on it then it should be fine I would think. I followed the guidance from Microsoft here: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension-rdg when setting up, but can share my own if useful?

It gets a little confusing as RDS kind of has its own built in NPS as well - that you need to disable parts of/forward other bits to the NPS server with the extension on.

Thats exactly  what I'm trying to do, seems better to use an existing working Radius/MFA setup but my RDS doesn't seem to attempt to connect to it

 

Any more info would be helpful!

[Davit2005]

1 hour ago, Sheridan said:

Thanks, I'm going to add another Radius server and add the MFA extension and use that - at least it keeps things seperate and leaves the working vpn setup alone (which I can remove when this is working!)

That is probably a better idea. When we had contractor set it up we already ran radius on servers for something else and they said not to mix it as it can cause issues so we span up separate NPS servers to install the extension.

Edited September 4, 2025 by Davit2005

[Sheridan]

I must be doing something fundamentally wrong here as it seems to ignore any NPS setting. When I test the login page with correct credentials I'm logged in fine - but the NPS logs on the RDS server and also the NPS/MFA show no logins (logging is set to show failed and successful attempts on both) 

 

My RDS server's NPS is set to authenticate to 'TS GATEWAY SERVER GROUP' which only contains one server (the NPS/MFA server) and the RDS Gateway RD-CAP is pointing to that server yet it authenticates somewhere correctly (without MFA) as it logs in when using correct credentials!

 

What I can't get around is why its not redirecting the authentication to the seperate NPS/MFA server as there's nothing else to configure!

[Davit2005]

1 hour ago, Sheridan said:

I must be doing something fundamentally wrong here as it seems to ignore any NPS setting. When I test the login page with correct credentials I'm logged in fine - but the NPS logs on the RDS server and also the NPS/MFA show no logins (logging is set to show failed and successful attempts on both) 

 

My RDS server's NPS is set to authenticate to 'TS GATEWAY SERVER GROUP' which only contains one server (the NPS/MFA server) and the RDS Gateway RD-CAP is pointing to that server yet it authenticates somewhere correctly (without MFA) as it logs in when using correct credentials!

 

What I can't get around is why its not redirecting the authentication to the seperate NPS/MFA server as there's nothing else to configure!

Is it possible to restarting the RDG server?

[StephenPink]

Here's my full documentation from when I set it up, hopefully helps - although I have mutliple GW servers and multiple MFA NPS servers;

 

Configure RADIUS CAPs on the Remote Desktop Gateway NPS

 

Need to configure two Connection Request Policies in NPS, one to forward requests to the Remote RADIUS Server Group (which is set to forward to NPS server running the extension), and the other to receive requests coming from MFA server (to be handled locally)

 

On RDS-GW Server

• Network Policy Server > Policies > Connection Request Policies
• Duplicate the "TS GATEWAY AUTHORIZATION POLICY" twice; rename them to "MFA Server Request No Forward" and  "MFA Server Request Forward"
• MFA Server Request No Forward:
  • Enable Policy
  • Conditions:
    • Client IPv4 Address > NPS SERVER 1 IP|NPS SERVER 2 IP
  • Settings:
    • Authentication > Authenticate requests on this computer
    • Accounting > Untick Forward
• MFA Server Request Forward:
  • Enable Policy
  • Conditions:
    • NAS Port Type: Virtual (VPN)
  • Settings:
    • Authentication > Forward to TS GATEWAY SERVER GROUP
    • Accounting > Forward to TS GATEWAY SERVER GROUP
• Disable the TS GATEWAY AUTHORIZATION POLICY and move to below the two MFA policies

 

 

RADIUS Client and NPS Policies

 

On both MFA NPS SERVER 1 and MFA NPS SERVER 2

• Network Policy Server > Right click on NPS (Local) > Register server in Active Directory

 

On MFA NPS SERVER 1 (remember changes made on MFA NPS SERVER 1 sync to MFA NPS SERVER 1 automatically as part of the failover)

• Network Policy Server > RADIUS Clients and Servers > RADIUS Clients > New
  • Friendly Name: Remote Desktop Gateway 1
  • Address: IP ADDRESS
  • Shared Secret: SHARED SECRET
• Repeat for RDS GATEWAY SERVER 2

 

• Network Policy Server > RADIUS Clients and Servers > Remote RADIUS Server Groups > New
  • Group Name: Remote Desktop Gateway Servers
  • Add:
    • Address > RDS GATEWAY SERVER 1 IP
  • Authentication/Accounting:
    • Shared Secret: SHARED SECRET
  • Load Balancing:
    • Number of seconds without response before request is considered dropped > 60
    • Number of seconds between requests when server is identified as unavailable > 60
  • Repeat for RDS GATEWAY SERVER 2

 

 

• Network Policy Server > Policies > Connection Request Policies
• New Connection Request Policy
  • Overview:
    • Policy name: To Remote Desktop Gateway
    • Type of network access server: Remote Desktop Gateway
    • Conditions:
      • NAS Port Type: Virtual (VPN)
    • Settings:
      • Authentication > Forward to Remote Desktop Gateway Servers
      • Accounting > Forward to Remote Desktop Gateway Servers
• New Connection Request Policy
  • Overview:
    • Policy name: From Remote Desktop Gateway
    • Type of network access server: Remote Desktop Gateway
    • Conditions:
      • Client IPv4 Address > RDS GATEWAY SERVER 1 IP|RDS GATEWAY SERVER 2 IP
    • Settings:
      • Authentication > Authenticate requests on this computer
      • Accounting > Untick Forward

 

Because the NPS server with the MFA extension was designated as the central policy store for RD CAPs, need to implement a new policy on the NPS server to authorize valid connections requests

 

 

• Network Policy Server > Policies > Network Policies
• New Network Policy
  • Overview:
    • Policy name: Remote Desktop Gateway CAP
    • Type of network access server: Remote Desktop Gateway
    • Conditions:
      • User Groups: Remote Desktop Services Users
    • Access: Access Granted
    • Authentication: Leave as default, but also tick "Allow clients to connect without negotiating an authentication method"
    • Everything else default

[Davit2005]

Have you tried rebooting the server 🙂