Open the RD Gateway console, and right-click the server name, choose the tab “RD CAP Store”.Choose a shared secret and note it – We’ll use the example “ThisIsNotASecret”Īfter performing the first 3 steps, its time to set up RD Gateway, NPS and the Azure MFA Server RD Gateway setup:.Open port 443 to your RD gateway server.For a good tutorial on how to install Azure MFA see the following link: link Deploy Microsoft Azure MFA on a different server, Please note: MFA and NPS cannot run on the same server due to NPS and MFA Radius clients running on the same ports.This can be done on a separate server, or on the RDS server if you have a small farm.

Deploy a standard RD-Gateway, with NPS.

To add MFA to RD gateway we need to perform the following prerequisites

This might sound like a large change but I always advise my clients to use RD gateway – mostly due to it being accessible from almost all locations due to running on port 443 and having SSL security is a nice added bonus. Of course there a solution instead of securing direct RDP access, you can decide to secure Remote Desktop Gateway and have your users connect to the Remote Desktop Gateway. I actually have a ticket outstanding with the Azure MFA team.

I’m not sure why Microsoft decided to not support 2012R2 RDP access. There is just one downside Out of the box Remote Desktop(terminal services) security does not work on Server 2012R2. The great thing about Azure MFA is that it becomes very easy to secure your local directory, but also your remote desktop connections or RDS your 2008/2012 farms. Azure MFA is a fantastic product – Its easy to setup and maintain, and not very costly to purchase (for pricing, click here).

Rd gateway mfa