I have a bunch of machines configured in Azure that use AAD to login. As they currently only require Username and Password I feel that they are at risk. If a user logs in on the web then they are prompted for two factor, but not if they login with the same account to a desktop.

How do I require two factor for RDP/terminal login to any computer joined to my AAD domain?

Just to be clear:

  • I have no on-premises Active Directory (and don't want)
  • I have no on-premises infrastructure (and don't want)

You can't. Azure Cloud MFA is only available for Office 365, Azure Portal Administration and Cloud Applications.

Available versions of Azure Multi-Factor Authentication

You can, however, install the Azure On-premises MFA Server and use an RD Gateway to accomplish this. RD Gateway is necessary for Windows Server 2012 R2 and later.

Remote Desktop Gateway and Azure Multi-Factor Authentication Server using RADIUS

For Windows Server 2012 and earlier:

Windows Authentication and Azure Multi-Factor Authentication Server

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.