When does per user MFA engage? (VPN question)

@Kay Peek

Thank you for reaching out.

Based on your questions above

If I enable per user MFA, will it come up on every Azure VPN connection? I followed this tutorial: https://video2.skills-academy.com/en-us/azure/vpn-gateway/openvpn-azure-ad-mfa#peruser but it doesn't seem very clear on that. (Also, I need all users to have access, so do I need to have assignment required for it to work?)

I checked internally regarding this, this can be done by setting cachesigninuser to false in client profile. You can change the <cachesigninuser>true</cachesigninuser> to <cachesigninuser>false</cachesigninuser> and then import the profile.

Example:

<type>aad</type>
<aad>
<issuer>https://sts.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/</issuer>
<tenant>https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47</tenant>
<audience>41b23e61-6c1e-4545-b367-cd054e0ed4b4</audience>
<cachesigninuser>false</cachesigninuser>
</aad>
</clientauth>

How long does the per user token last if you don't set it to remember?

I think this should be configurable from Azure Entra Side. Is the requirement here to sign-off users after the token has expired?
You can refer to this document here
https://video2.skills-academy.com/en-us/entra/identity-platform/configurable-token-lifetimes

• If they use SSO then attempt to log into the VPN, is that a different token or the same token for MFA?(Meaning will it prompt for each instance?)

Regarding this question, can you let us know if machine used to login will part of the corporate network or the machine will be part of an outside network?

Reference article:

https://video2.skills-academy.com/en-us/windows/security/operating-system-security/network-security/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections#active-directory-requirements

Thank you!

Thanks for the reply. These are all domain joined devices.