Azure MFA NPS Extension: brute forces via non allowed accounts

Question

Dear,

We've setup NPS with Azure MFA 3rd party extension for our SSLVPN. Via the network policy in NPS we've limited VPN access to a specific security group.

However: now we see that our onpremise Administrator account locks out frequently. Further research leads us to the source: brute forces via SSLVPN on the administrator account.

The strange thing is that our administrator account is not in the specific VPN security group we've defined in the connection request policy.

In the event vwr we see this as an error on the administrator brute force attempt: ""The request was discarded by a third-party extension DLL file"

How does this come? I expected that the administrator connection attempt was denied before contacting Azure AD or before the login was attempted through onpremise AD because administrator user was not in the specific security group.

Any ideas? Is this normal behavior when Azure AD MFA 3rd party MFA extension was installed?

Thank you so much!

Pieter