Use Microsoft Entra ID Multifactor Authentication (MFA)

This works exactly in the same way as regular Microsoft Entra ID authentication policy but is used to determine which accounts are in scope for MFA.

Once you have configured your policies, click the Update button at the bottom of this page to activate your settings.

If you enable an MFA policy and immediately authentications fail without notifications being sent to user devices, it either menas:

You may find your users are repeatedly sent push notifications when their devices either roam between access points or reconnecting during suspend and resume cycles.

This can be due to a number of reasons:

A common issue is by default RADIUS clients (eg. wireless access points, VPN appliances and networking switches) expect replies to an authentication to complete within a few seconds which is not long enough for a push notification to make it to a user’s phone, that notification to be interactively reviewed and confirmed and then response to make it back to the RADIUS service.

This leads to timeouts and authentication failures.

The workaround is to increase any RADIUS timeout values to thirty (30) seconds, any higher will have no effect; for MikroTik equipment the configuration parameters are called timeout and radsec-timeout.

Microsoft detail a number of limitations of their MFA integration when used with RADIUS that you should make yourself aware of.

A common question is why only push notifications are supported. There is no restriction on the server side to allow different options but the blocking issue is the lack of client side (device supplicant) support to allow this.

Technically using EAP-TTLS with EAP-GTC as your inner method would work but unfortunately the major OS vendors (Android, Microsoft Windows and Apple iOS) have broken implementations of EAP-GTC that instead of treating this as a way to perform an interactive challenge it is instead treated as a generic ‘prompt for password’ field with the following behavior: