I'm looking to set up Azure VPN for my users as they have a Azure hosted DC now. I've set up the Azure VPN and it works, but they have a requirement of needing MFA for each authentication to VPN. So my questions are: If I enable per user MFA, will it come up on every Azure VPN connection? I followed this tutorial: https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-mfa#peruser but it doesn't seem very clear on that. (Also, I need all users to have access, so do I need to have assignment required for it to work?) How long does the per user token last if you don't set it to remember? If they use SSO then attempt to log into the VPN, is that a different token or the same token for MFA?(Meaning will it prompt for each instance?) They have business standard, so I cannot use conditional access and even then, I don't know if it procs every time.

When does per user MFA engage? (VPN question)

Kay Peek 5

I'm looking to set up Azure VPN for my users as they have a Azure hosted DC now. I've set up the Azure VPN and it works, but they have a requirement of needing MFA for each authentication to VPN. So my questions are:

If I enable per user MFA, will it come up on every Azure VPN connection? I followed this tutorial: https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-mfa#peruser but it doesn't seem very clear on that. (Also, I need all users to have access, so do I need to have assignment required for it to work?)
How long does the per user token last if you don't set it to remember?
If they use SSO then attempt to log into the VPN, is that a different token or the same token for MFA?(Meaning will it prompt for each instance?)

They have business standard, so I cannot use conditional access and even then, I don't know if it procs every time.

ChaitanyaNaykodi-MSFT 26,951 Reputation points Microsoft Employee

2024-08-16T15:04:53.4933333+00:00
@Kay Peek

Thank you for reaching out.

Based on your questions above

If I enable per user MFA, will it come up on every Azure VPN connection? I followed this tutorial: https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-mfa#peruser but it doesn't seem very clear on that. (Also, I need all users to have access, so do I need to have assignment required for it to work?)

I checked internally regarding this, this can be done by setting cachesigninuser to false in client profile. You can change the <cachesigninuser>true</cachesigninuser> to <cachesigninuser>false</cachesigninuser> and then import the profile.

Example:

<type>aad</type> <aad> <issuer>https://sts.windows.net/xxxxxxxx/</issuer> <tenant>https://login.microsoftonline.com/xxxxxxx</tenant> <audience>xxxxxxxxxxxxxxxxxxxx</audience> <cachesigninuser>false</cachesigninuser> </aad> </clientauth>

How long does the per user token last if you don't set it to remember?

I think this should be configurable from Azure Entra Side. Is the requirement here to sign-off users after the token has expired?
You can refer to this document here
https://learn.microsoft.com/en-us/entra/identity-platform/configurable-token-lifetimes

If they use SSO then attempt to log into the VPN, is that a different token or the same token for MFA?(Meaning will it prompt for each instance?)

Regarding this question, can you let us know if machine used to login will part of the corporate network or the machine will be part of an outside network?

Reference article:

https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections#active-directory-requirements

Thank you!
Kay Peek 5 Reputation points

2024-08-16T20:34:35.5966667+00:00

Thanks for the reply. These are all domain joined devices.
Kay Peek 5 Reputation points

2024-08-21T21:50:55.1166667+00:00

@ChaitanyaNaykodi-MSFT Any other word on this? Also, it appears tokens can now only be set to expire if you use Conditional Access, which is not available with their licensing, is that correct?

Share via

When does per user MFA engage? (VPN question)

Your answer