How to use cloud Azure MFA with ASA Vpn and Cisco AnyConnect?

[davidbnbf]

I can find a bunch of documentation on how to install an on premise Azure MFA server however we are already setup for the cloud version of MFA and don't want to migrate on premise with that.  I would like to integrate our Cisco ASA VPNs using Cisco AnyConnect Secure Mobility client to use the cloud based Azure MFA and Microsoft Authenticator.  Is this possible?  Anyone tried this or point me in the right direction on the minimum amount of work to configure this setup?

[davidbnbf]

Can you post instructions or documentation for transitioning to cloud MFA with SAML?

[philip moore]

Here it describes scenario for Citrix and asa

https://docs.microsoft.com/bs-latn-ba/azure//active-directory/authentication/howto-mfaserver-nps-vpn

[MARK BAKER]

Hi Philip,

Do you have a link to this announcement? 

Thanks,
Mark

[philip moore]

https://docs.microsoft.com/bs-latn-ba/Azure/active-directory/authentication/howto-mfaserver-nps-vpn

As of July 1, 2019, Microsoft will no longer offer MFA Server for new deployments. New customers who would like to require multi-factor authentication from their users should use cloud-based Azure Multi-Factor Authentication. Existing customers who have activated MFA Server prior to July 1 will be able to download the latest version, future updates and generate activation credentials as usual.

[HubbaBubbaCakes]

Hi, 

We have this mostly working but it does a MFA challenge every time you log into VPN. Is that what's happening for you?

[alvarezax]

Hi David,
can you share the steps you followed while implemented the solution you mentioned in your post? I currently have a NPS with Azure connector and I'm trying to integrate Cisco ISE. The NPS by itself works fine with MFA adn Azure, the issue is teh integration of ISE into the mix. I tried configuring the NPS as a external radius and also using a radius token to point to it but both get stuck on the NPS. If there is a way to integrate the ISE directly to the Cloud Azure I would really appreciate if you share with us that information. Thank you

[Chekol Retta]

How did you get around with expired password? NPS extension doesn't support renewing expired password. Users are not getting the prompt to renew their password when they login to Anyconnect with Azure MFA