Cisco Anyconnect with on-premises AD and Microsoft Authenticator MFA

[dganta]

HI,

We are looking to integrate our Cisco anyconnect with Microsoft MFA for secondary authentication with primary authentication being on-premises AD, we are as of now integrated it with DUO MFA for secondary authentication and want to migrate that to Microsoft MFA, however cannot see the document for the same anywhere can we  configure this  without NPS extension just using on-premises AD

[Marvin Rhoads · Accepted solution]

AnyConnect, acting as the VPN client to a headend ASA or FTD device, cannot currently authenticate directly with Microsoft MFA, either as primary or secondary authentication. It can authenticate via SAML to Azure AD and then Azure can be set to use Microsoft MFA. Similarly it can use the NPS extension as you alluded to.

[CeeDeeLight]

@Marvin Rhoads  I would greatly appreciate your insight. I am responding to someone's previous post (dganta) and you provided an answer. I would like to know if the same situation exists now in 2025. The same is for my environment, we are looking to integrate our Cisco AnyConnect with Microsoft MFA for secondary authentication with the primary authentication being on-premises AD. We too have it integrated with DUO MFA for secondary authentication and want to migrate to Microsoft MFA. Is this possible with on-premises AD or would we need to be on Microsoft Entra ID (formerly Azure AD).  Thank you in Advance.

[dganta]

Thank you Marvin for the reply. 

[mingjuwu]

pls take a look on this tech 

 https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/215935-configure-asa-anyconnect-vpn-with-micros.pdf