How to logon with Azure AD credentials on a Windows 10 device with MFA enabled

[Deleted]

Hi together,

maybe one of you have got the same requirements and run into the same problem.

situation:

Windows 10 enterprise or windows 10 s

Microsoft Intune Cloud (EMS)

Microsoft Multi-Factor Authentication (MFA) on-premises handled by ADFS (internal no mfa, external (wap) force mfa)

Company Wifi protected with certificates

Credentials from Azure AD

Problem 1:

As far as I have found, Intune is only able to deploy user certificates (SCEP profile) for wifi on windows devices. This causes us that you initially can only logon with your azure ad credentials to a windows machine if you have plugged in the company network or you have a public wifi connection with no authentication, so that you can connect to a wifi on the logon screen. Does anyone managed to deploy client certificates with Intune?

Problem 2:

As mentioned above we use MFA on-premises and it’s handled by adfs. If a user authenticates from external (over wap) we force mfa on adfs side. This is fine for web applications and other apps but it seems that windows logon cannot handle mfa request and therefore it fails. Does anyone know if this can be achieved somehow that this scenario works? Could this be handled by conditional access?

The goal should be that we can use a windows 10 enterprise or windows 10 s device with azure ad credentials which is authenticated to our company wifi network at logon screen already and that we can use multi-factor authentication somehow.

Thanks in advance for any input!

[#2]

Hi Philipp,

it's currently not possible to deploy device certificates with Intune. There is a uservoice item for it where you can vote for:

https://microsoftintune.uservoice.com/forums/291681-ideas/suggestions/19805320-deploy-unique-compute...

As long as there are no device certificates you have to use a different authentication for your Wi-Fi. I know it's not ideal at the moment. My customers are struggling with this fact also.

If you are using AAD joined devices then I suggest to use Windows Hello for Business for device authentication (Windows Logon). This gives you a kind of MFA (device level, you need to have the device and pin or biometric) for the Windows Logon. For all your cloud applications or published applications via Azure App Proxy I would choose Conditional Access to enforce MFA.

best,

Oliver

[#3]

I was looking for the same and found this:

"No, you cannot secure console loggings with MFA. For windows 10, you can perform MFA when doing an AAD Join. Once that is done, the device is considered a trusted device and MFA shouldn’t be required anymore. We are relying on windows password and windows hello for business for strong authentication on the device."

from: https://social.msdn.microsoft.com/Forums/azure/en-US/ac4b91ff-b0ec-4b50-a07c-b31696c71cf4/azure-mfa-...

[#4]

The latest Windows 10 Insider build (17713 ) brings us Web-sign in, is that what you are looking for?

Until now, Windows logon only supported the use of identities federated to ADFS or other providers that support the WS-Fed protocol. We are introducing “Web Sign-in,” a new way of signing into your Windows PC. Web Sign-in enables Windows logon support for  non-ADFS federated providers (e.g. SAML).

https://blogs.windows.com/windowsexperience/2018/07/11/announcing-windows-10-insider-preview-build-1...