Hi Cristian, I gone through below link which you share and need some clarification.
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension-vpn
The VPN server receives an authentication request from a VPN user that includes the username and password for connecting to a resource, such as a Remote Desktop session.
In this procedure anyconnect client send request to ASA with primary credentials.
Acting as a RADIUS client, the VPN server converts the request to a RADIUS Access-Request message and sends it (with an encrypted password) to the RADIUS server where the NPS extension is installed.
In this procedure, ASA converts request to Radius request and send to NPS server(Radius server)
The username and password combination is verified in Active Directory. If either the username or password is incorrect, the RADIUS Server sends an Access-Reject message.
lets suppose Primary auth get success
If all conditions, as specified in the NPS Connection Request and Network Policies, are met (for example, time of day or group membership restrictions), the NPS extension triggers a request for secondary authentication with Azure Multi-Factor Authentication.
If primary auth get success NPS extension triggers a request for secondary auth with MFA. So here do we need also to configure secondary auth on ASA pointing again to same NPS server as for Primary auth, please clear.
Azure Multi-Factor Authentication communicates with Azure Active Directory, retrieves the user’s details, and performs the secondary authentication by using the method that's configured by the user (cell phone call, text message, or mobile app).
If user get code as secondary auth on phone where does it need to put as there is only one password filed in anyconnect client application so how to get another field to put secondary auth in anyconnect client application.
Please clear.
