Hello
I have had my initial play with ISE 3.0 and ROPC integration to AzureAD. I setup my EAP-TTLS supplicant to perform PAP-ASCII authentication against a user account in Azure. It was all going quite well until I realised that the authentication was failing because the Azure user account was subject to Microsoft MFA (Multi Factor Authentication).
I guess this is not an uncommon scenario - MFA protection of an employee account requires the MFA acceptance every time that user logs into a web browser or new instance of Teams etc. - the usual stuff. But. It breaks network authentication
Has anyone run into this before, and if so, how do you get around it without disabling MFA?
The use case is: using Azure AD user accounts to perform 802.1X authentication over ROPC (EAP-TTLS).
When using an on-prem AD Domain Controller, which synchronises user accounts up to Azure, the EAP-PEAP works great, because the on-prem AD Domain Controller obviously doesn't enforce the MFA step (because it's not aware of it). The plan was to not use an on-prem AD for network authentication.
thanks in advance
