Remote Dekstop Connection using Azure MFA

[mrktos]

Hello Everyone,

I am facing a little problem now. We are thinking to implement MFA to login in to our servers on-prem from internal network. Obviously we can use some third party tools such us DUO or AD Professional Plus. However from what I can see there is a possibility to use RD Gateway with NPS that will have MFA plugin on it. I just need to understand something correctly - am I right saying that I can handle all RDP traffic to all the servers through RD Gateway that will be redirecting authentication through NPS to Azure MFA or it is no go?

Regards,

Wojciech

[#2]

@mrktos 

I currently have two servers setup as Jump Servers for RDP using Azure MFA on Premises.  My setup has one installation on each server and they act as a cluster staying in sync.  I believe you can achieve the same results using a server less approach by following the steps outlined here using the NPS extensions.  https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension 

This will allow you to the same results.  I hope this helps, I originally started administering MFA 6 years ago using PHONEFACTOR which evolved into Windows Azure Multi-Factor Authentication Server.  Our environment is PCI and this approach has worked well for us.

[#3]

@BeAzurewe have exactly same topology so we use Jump Servers to connect to other servers. My question now is. Do you include NPS role on this Jump Servers? Can you share a little bit more with me how you have completed this setup?

Regards,

Wojciech

[#4]

@mrktos 

I've found the NPS extension to work great at MFA-protecting all NPS requests. In addition to all RDP connections, we even have our cisco firewall and switches logins (RADIUS auth to the NPS server) protected with Azure AD+MFA now.

One key thing that I struggled with early on was trying to have the MFA NPS extension installed on the same server as the RDG (RD Gateway) server. Need to have RDG on its own server, and NPS w/ the extension on its own server, otherwise there are unresolvable auth issues that occur.

[#5]

@PrestonMI can confirm I got this working today with NPS Extension - setup was straight forward. Thank you all for the support.

[#6]

@mrktos does the Azure MFA with RDS work with SMS messages and phone calls 

if so can you share any pick of how it looks 

thanks