Common pitfalls when setting up the NPS extension for Microsoft Multi-Factor Authentication

FI have already set up Microsoft MFA via Citrix Netscaler for many customers and have encountered various issues in the process. Here is a summary of the Stumbling blocks while setting up the NPS extension for Azure AD multi-factor authentication (MFA). I’ve already encountered every possible issue at once with one of my clients.

Microsoft Azure AD Multi-Factor Authentication (MFA) is a very popular option for customers looking to implement flexible two-factor authentication that is also very user-friendly. Setting up the NPS extension for MFA is actually straightforward—or so it seems! Here is a summary of the issues that have arisen so far.

• For communication, it is necessary to TLS 1.2 must be enabled for PowerShell. To do this, run the following command in PowerShell as an administrator:
  [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

• The PowerShell script AzureMfaNpsExtnConfigSetup.ps1 has hard-coded $user=’NETWORK SERVICE'‚This sets the permission to access the certificate's private key for communication.
  However, if the systems are in German, for example, then it should Network service and must therefore be adjusted in the script!
• Even when using Azure AD Free, you must have at least the Azure AD Premium Trial enabled during setup.
  To do this, simply go to "Licenses" in Azure AD and activate the trial—it only takes a few seconds.
• If you enable the NPS role on a Server 2019, you will have incorrect local firewall rules.
  These must be deleted and recreated for UDP 1812/1813
• The certificate for the Azure Multi-Factor Authentication client must be renewed every two years; please read the following Post.
• If the „Approve/Deny“ method is to be retained, then the key must OVERRIDE_NUMBER_MATCHING_WITH_OTP on FALSE be set.
• If you use NTLMv2 authentication, you must use MS-CHACP-V2 and also set the following registry value
  HKLMSystemCurrentControlSetServicesRemoteAccessPolicy
"Enable NTLMv2 Compatibility" REG_DWORD = 0x00000001

If you're having any other issues with installing the NPS extension, please let me know.