Using SSO / Cached Credentials with MFA

[joemrris1]

Hi, 

I have configured MFA authentication for the Cisco AnyConnect VPN, however it still requires the full email and password each time, prior to sending the MFA prompt.

Is there a way to configure AnyConnect to use the credentials on the machine so that the user is only required to authenticate using the MFA prompt, and not a full logon as well.

Thanks!

[Marius Gunnerud]

As far as I know you cannot pass the machine credentials to AnyConnect on login.  An option could be to use certificate authentication with SAML.  Then you users would not need to enter username and password, but still be required to perform dual authentication.

[hash2k2]

I just set up Cisco AnyConnect with Azure MFA and at our clients the cached/stored credentials for Teams or Outlook are getting passed to AnyConnect. So, you click "connect" and the connection is build up. If you use a notebook without any Teams or Outlook profile, you get asked for username/password and the MFA token. I am looking for how to get this removed.