Azure MFA is a fantastic product – Its easy to setup and maintain, and not very costly to purchase (for pricing, click here). The great thing about Azure MFA is that it becomes very easy to secure your local directory, but also your remote desktop connections or RDS your 2008/2012 farms. There is just one downside; Out of the box Remote Desktop(terminal services) security does not work on Server 2012R2. I’m not sure why Microsoft decided to not support 2012R2 RDP access. I actually have a ticket outstanding with the Azure MFA team.

Of course there a solution; instead of securing direct RDP access, you can decide to secure Remote Desktop Gateway and have your users connect to the Remote Desktop Gateway. This might sound like a large change but I always advise my clients to use RD gateway – mostly due to it being accessible from almost all locations due to running on port 443 and having SSL security is a nice added bonus.

To add MFA to RD gateway we need to perform the following prerequisites ;

1. Deploy a standard RD-Gateway, with NPS. This can be done on a separate server, or on the RDS server if you have a small farm.
2. Deploy Microsoft Azure MFA on a different server, Please note: MFA and NPS cannot run on the same server due to NPS and MFA Radius clients running on the same ports. For a good tutorial on how to install Azure MFA see the following link: link
3. Open port 443 to your RD gateway server.
4. Choose a shared secret and note it – We’ll use the example “ThisIsNotASecret”

After performing the first 3 steps, its time to set up RD Gateway, NPS and the Azure MFA Server

RD Gateway setup:

• Open the RD Gateway console, and right-click the server name, choose the tab “RD CAP Store”
• Turn off the “Request clients to send a statement of health” check box if you have clients that are not NAP capable.
• Select “Central server running NPS” and remove the current server if there is any, Now enter the hostname of the MFA server and our selected shared secret “ThisIsNotASecret”.
• Close the Console – we’re done on this side. 🙂

NPS Setup:

• Open the NPS console and go to RADIUS Clients, Right click and select New
• Enter a friendly name – e.g. AzureMFA and note this.
• enter the IP of the MFA server & our selected shared secret “ThisIsNotASecret”
• click OK and move to “Remote Radius servers” in the left hand menu.
• Double click the default TS Gateway Server Group and click edit, select the Azure MFA server from this list and click on load balancing.
  • Change the priority to 1 and the weight to 50
  • change the number of seconds before a connection is dropped to 45 seconds.(could be less, but I select 45 seconds to keep uniformity among servers)
  • Change the number of seconds before server is unavailable to 45 seconds.(could be less, but I select 45 seconds to keep uniformity among server
  • Click OK and close this window. Move to Connection Request Policies
• You should see the default connection policy here – disable or delete this, as we will create our own policies.
• Right click the policies and select “New” Name this policy “Receive MFA Requests”. The settings for this policy are:
  • NAS Port type: Virtual(VPN)
  • Client Friendly Name: AzureMFA
  • Authentication Provider: Local Computer
  • Override Authentication: Disabled
• Create another policy and name this “Send MFA requests”. The settings for this policy are:
  • NAS Port type: Virtual (VPN)
  • Accounting provider name: TS GATEWAY SERVERS GROUP
  • Authentication Provider name: TS GATEWAY SERVER GROUP
  • Authentication provider: Forwarding request
• And that concludes the NPS setup. Almost there! 🙂

Azure MFA Setup:

The last steps are fairly straight forward:

• Open the MFA administrator console and select the RADIUS option in the left hand menu.
• Enable Radius and on the clients tab add the IP of the NPS server.
• enter the shared secret “ThisIsNotASecret”.
• Now select the tab “Targets” and enter the IP of the RDS Server.
• Go to the left hand menu and select user. Enable a user for tests with SMS messages or the app.
• Open the Windows Firewall for inbound Radius traffic
• Test! 🙂 If you followed the manual to the letter you now secured your RD Gateway with MFA.

Happy MFA’ing! 🙂