Forum Discussion
Using Microsoft MFA on RDS with FSLogix
We have a Windows 2019 RDS collection consisting of 7 x RDSH servers. We have a Conditional Access Policies which enforces MFA when accessing any M365 resource. We had previously excluded our office WAN IP (i.e: a trusted location) from the CA policy. This was to allow RDS users to operate without needing to provide MFA. However, we found that some office based users had never registered for MFA, since they only work on-site. This posed a security risk, so we decided to remove our office IP from the CA policy exceptions list. Now, all users are MFA registered, however, they're experiencing repeated prompts for MFA while working in the RDS environment. For instance, when a user opens Outlook, they are challenged for MFA 3 or 4 times. This doesn't happen if they're working locally on their laptop. In our CA policy, we have configured the 'sign-in frequency' to 90 days, but this does not seem to make any difference on the RDS. I suspect this issue arises because we're using FSLogix user profiles and office containers and a user might be placed on RDS1 one day and then on RDS7 the follow day. Is there anyway to save the MFA session token within the users FSLogix profile?
2 Replies
Likely because Azure AD treats each session or server connection independently, prompting for MFA again if the session isn't recognized as part of an ongoing MFA context.
Potentially yes, but not straightforward. MFA tokens are usually stored in browser cookies or app-specific token caches, which are ephemeral or stored locally in a way that doesn’t automatically roam with FSLogix profiles.
