How to setup MFA with WVD?

[gadmin285]

Hi

I have a idea about how we setup MFA when we login to our Azure Portal. I have a scenario now like I want to use MFA when users login into WVD machine. Is it possible? if so how can I achieve it? Please give me some suggestions or inputs. Thanks

[#2 · Accepted solution]

@gadmin285 Hi, make sure you are familiar with the following documentation on how to setup MFA for WVD service : https://docs.microsoft.com/en-us/azure/virtual-desktop/set-up-mfa

Shoul cover everything you need.. Regards, MS 

[#3]

If you have an Azure AD Premium P1 license, I would recommend that you implement MFA with a conditional access policy.

https://docs.microsoft.com/en-us/azure/virtual-desktop/set-up-mfa

I hope this helps. Regards, Tom Wechsler @gadmin285 

[#4]

Thanks for the suggestion. I guess this will work, but we have to get the AAD license here. Can't we just use normal MFA and achieve MFA while we are logging into WVD?

[#5]

You can set up MFA in the portal and when users access the WVD infrastructure they will be asked to work with MFA. The advantage with a conditional access policy is that you can set up MFA explicitly for WVD.

https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-d...

I hope this will help. Regards Tom Wechsler@gadmin285 

[#6]

I understand now. We can configure the normal MFA, and when ever user's try to login to the WVD they will be asked to put a verification code (I have tested this yesterday) and the other way is purchase the P1 or P2 license and setup MFA with conditional access. This will be expensive as we pay for the license. So my doubt has been cleared. Thanks Tom Wechsler for all the suggestions. @TomWechsler 

[#7]

I was happy to help. Regards Tom Wechsler @gadmin285 

[#8]

@MaximSokoloff 

Is a hardware token supported in a WVD and or a Citrix VDI scenario?

This would be useful in scenario in a call centre environment where users are not allowed to use their mobile device so cannot receive an sms, or use the authenticator app to retrieve their passcode.

[#9]

You can setup hardware tokens in azure mfa and then change your preference for those users to be the hardware token and not the authenticator app. We do this for many clients where phones are not allowed in their place for work.

You can also just have multiple methods but you'll want to set the preferred method for the one most used as that will be the default one Microsoft provides.