Cisco Anyconnect with on-premises AD and Microsoft Authenticator MFA

[dganta]

HI,

We are looking to integrate our Cisco anyconnect with Microsoft MFA for secondary authentication with primary authentication being on-premises AD, we are as of now integrated it with DUO MFA for secondary authentication and want to migrate that to Microsoft MFA, however cannot see the document for the same anywhere can we  configure this  without NPS extension just using on-premises AD

[Marvin Rhoads · Accepted solution]

AnyConnect, acting as the VPN client to a headend ASA or FTD device, cannot currently authenticate directly with Microsoft MFA, either as primary or secondary authentication. It can authenticate via SAML to Azure AD and then Azure can be set to use Microsoft MFA. Similarly it can use the NPS extension as you alluded to.

[dganta]

Thank you Marvin for the reply. 

[mingjuwu]

pls take a look on this tech 

 https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/215935-configure-asa-anyconnect-vpn-with-micros.pdf