Forum Discussion
Remote Dekstop Connection using Azure MFA
Hello Everyone,
I am facing a little problem now. We are thinking to implement MFA to login in to our servers on-prem from internal network. Obviously we can use some third party tools such us DUO or AD Professional Plus. However from what I can see there is a possibility to use RD Gateway with NPS that will have MFA plugin on it. I just need to understand something correctly - am I right saying that I can handle all RDP traffic to all the servers through RD Gateway that will be redirecting authentication through NPS to Azure MFA or it is no go?
Regards,
Wojciech
- BeAzureCopper Contributor
I currently have two servers setup as Jump Servers for RDP using Azure MFA on Premises. My setup has one installation on each server and they act as a cluster staying in sync. I believe you can achieve the same results using a server less approach by following the steps outlined here using the NPS extensions. https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension
This will allow you to the same results. I hope this helps, I originally started administering MFA 6 years ago using PHONEFACTOR which evolved into Windows Azure Multi-Factor Authentication Server. Our environment is PCI and this approach has worked well for us.
- PrestonMCopper Contributor
I've found the NPS extension to work great at MFA-protecting all NPS requests. In addition to all RDP connections, we even have our cisco firewall and switches logins (RADIUS auth to the NPS server) protected with Azure AD+MFA now.
One key thing that I struggled with early on was trying to have the MFA NPS extension installed on the same server as the RDG (RD Gateway) server. Need to have RDG on its own server, and NPS w/ the extension on its own server, otherwise there are unresolvable auth issues that occur.
- -WesleyCopper Contributor
PrestonMQuestion looking through the document from itnetowrks.com below. It suggests that the NPS run on an AD Server. have you seen anything to suggest that to be nessasary? I have our NPS on its own we have been using for Wireless and was thinking of implementing MFA for RDP, for the same server. Also, do you see any reason I could not use our NPS servers at our other sites the same way for wireless and MFA?
https://www.itnetworks.com.au/how-to-configure-mfa-for-rds/