MFA on-premise

Question

Hello
I'd like to know whether is possible to manage MFA for on-premise group of users as well .
The need is for having on-premise authentication for a group of privileged user to be forced to use MFA for interactive login or UAC

Answer 1

Microsoft does not support MFA server for new deployments, but if you have an existing MFA server and your users exist on premises you can enforce MFA conditionally via Remote Desktop Gateway. Note, however, that the server still needs to reach out to Azure for the MFA portion, but your users can be entirely on premises. You just need to have the correct number of licenses for your on-premises users.

For new deployments it is recommended to use NPS extension and Azure MFA for on-premises applications.

https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfaserver-nps-rdg

Answer 2

Hi sc2111 ,

For on premise highly privilege accounts, you can use PAM and along with PAM you can use Azure MFA. Refer below URL for more information:-

https://learn.microsoft.com/en-us/microsoft-identity-manager/pam/privileged-identity-management-for-active-directory-domain-services

Thanks,Ravi

Answer 3

You can enable and manage MFA for any/all on-premise (Active Directory) users with a third party software called UserLock.

Enable MFA on Windows logins, RDP & RD Gateway, VPN and IIS connections. It also allows you to use on-premise AD credentials (and MFA) to securely access cloud applications such as Office365.

Hope this helps. More information at [http://www.userlock.com/