VPN authentication using Azure MFA(SaaS model)

[Madhuri Dewangan]

Hi Team,

One of my customer is having MS Azure MFA (SaaS model). They want it to use it for 

1. VPN user authentication

2. Network Device administration

Wanted to know regarding the possibility to integrate ISE with Azure MFA(SaaS model) and integrate ASA and Azure MFA(SaaS model)  VPN user authentication.

Is there any document available for the same.

Thanks and Regards,

Madhuri

[Jason Kunst]

Ise doesn’t integrate with azure for AAA services. We need to talk to active directory or other supported external identity sources

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01110.html#concept_BD3A270FEC0C411DA10FB808C14B48D5

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/compatibility/b_ise_sdt_24.html#externalidstores

Please reach out to our product managers at http://cs.co/ise-feedback or internally at http://cs.co/ise-pm

[paul · Accepted solution]

To integrate with Azure MFA you use NPS servers locally with the MFA extension to talk to Azure MFA:

https://www.microsoft.com/en-us/download/details.aspx?id=54688

Then ISE can do a RADIUS token or RADIUS proxy integration with the NPS servers.