Discovering Azure

Today I would like to focus a little bit on NPS. I often come across the issue with VPN access granted without MFA approval on NPS servers. This is a common problem that technicians often don’t know how to deal with, bouncing the ticket around like a ball — from the Network team to the Windows team, and finally to the Identity team. Today, I’d like to give you a closer look at this problem and show you the potential solution.

When a new NPS server is set up, the VPN connection must be established. On newly created servers or on the servers where NPS certificate has expired the connection is possible without approving the MFA request. Most of the time, the MFA authentication request is received on the registered device, but even if it is not approved, the VPN connection is still established.

What is the Expected Behavior?

VPN connection should only be established once MFA approval is successfully confirmed.

Described situation allows unauthorized VPN access without second-factor verification, creating a potential security breach. So, what is the solution to that problem?

Let’s assume that our NPS server has already been created, the role has been installed and configured correctly, but we are facing an issue with MFA — it is either missing or not working properly. We need to install the MFA extension on the server, which is available for download from Microsoft’s website. You can find it at this link:

https://www.microsoft.com/en-us/download/details.aspx?id=54688

Install the extension you downloaded:

Once its’ done, the new files will appear in path: C:\Program Files\Microsoft\AzureMfa\Config

You need to launch the script located there, which

registers the NPS server with Azure AD

• Creates a certificate for the server.
• Uploads the certificate to Azure AD so the NPS extension can securely talk to Azure MFA.

configures the registry and local settings

• Adds required registry keys under HKLM\SOFTWARE\Microsoft\AzureMfa.

• Stores configuration details, like the certificate thumbprint and tenant information.

links the NPS extension with your Azure tenant

• During execution, you’ll be asked to sign in with Azure AD Global Admin credentials. You will also be asked to provide your Tenant ID which can be found here:

• The script then associates the server with your Azure AD tenant, so it can enforce MFA for RADIUS authentication requests.

Once the script finishes running, the MFA extension will be installed, and VPN connections will require two-factor authentication. But that’s not the whole story. By default, MFA prompts users for a one-time password, while many prefer the convenience of approving access directly in the app. It’s a common request to switch this configuration. So, how can you do it from the server side? The solution is to create a registry string OVERRIDE_NUMBER_MATCHING_WITH_OTP with the value set to FALSE in the path LOCAL_MACHINE\SOFTWARE\MICROSOFT\AZUREMFA

You can do that by using the AzureMfa_Overriding_Number.ps1 or the small script below:

$regPath = "HKLM:\SOFTWARE\Microsoft\AzureMfa"
$regName = "OVERRIDE_NUMBER_MATCHING_WITH_OTP"
$regValue = "false"

if (-not (Test-Path $regPath)) {
    New-Item -Path $regPath -Force | Out-Null
}

New-ItemProperty -Path $regPath -Name $regName -Value $regValue -PropertyType String -Force
Write-Output "Registry entry '$regName' created/updated successfully at $regPath with value '$regValue'."

Thanks to that entry users will approve their MFA requests in the application.

Hope this short article will clear up any doubts you may have about connecting via VPN without MFA on NPS servers. It doesn’t matter whether this action is performed by the person responsible for the network, the operating system, or identity as long as he/she has the Global Admin role on their account.