Azure MFA using NPS without local domain?

[JayBeeFinalBeta]

Hi, I have a site where I want to protect the VPN service using (RADIUS) and Azure MFA. 

The site currently doesn't have a local active directory domain controller. The users connecting to the VPN are Azure AD users (P1). 
I'm hoping not to need to set up a local domain controller, but just keep the NPS server in a workgroup. Is this possible? 

[#2 · Accepted solution]

Hi Jay,

Not possible with NPS, I actually used the NPS extension for Azure P2S last year, you don’t need to have MFA server but you must have Local domain to do the authentication part.

You may have to look for different Radius setup like DUO for instance!

https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension

[#3]

What kind of VPN provider are you using.

There are a lot of VPN providers that have native authentication to Azure AD.
Check out this Reddit article for some examples: https://www.reddit.com/r/sysadmin/comments/db05ih/vpn_with_azure_ad_authentication/

[#4]

@Thijs Lecomte That's a good suggestion. I did look at that, unfortunately, my hardware firewall doens't support it and I need to resort to RADIUS. 

[#5]

@Moe_Kinani Fair enough, I've just implemented an NPS server with the Extension (leaning on a local AD too). I like DUO very much, it can do things MS should have done out of the box a long time ago (like easy RDP MFA). But the idea is to have everything using the same authentication (and I'm now using SAML to AzureAD on all webservices)