HA for Azure MFA server

Question

The full RDS with MFA setup is deployed on Azure with Azure AD and Azure Azure Active Directory domain services. We have slave MFA server but it is disabled at the moment and not taking any replication.

We have 2 load balanced RDS gateway servers and NPS installed on the same and both servers pointing to same radius client which is our MFA server.

Now, we have to add another MFA server and load balance it. My question is which load balancer we should use, Azure internal load balancer or an NLB setup.

Once the load balancer is setup, what all configurations I need to perform on NPS and MFA server.

Answer

Hi @Akshay Vithalkar ,

There are no special instructions required for load balancing NPS extension servers. You stand up every server as you did the first and route the requests through a load balancer. NPS servers are stateless and can process every request independently so they can scale with load as needed.

As stated in the documentation, "The NPS extension automatically handles redundancy. You can create as many Azure MFA-enabled NPS servers as you need." : https://video2.skills-academy.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension#plan-your-deployment

This article uses NetScaler for load balancing the NPS servers so should be useful for your purposes. https://jkindon.com/2018/03/05/azure-mfa-nps-extensions-with-netscaler-nfactor-authentication/

(See this similar thread on Reddit, and this one on MSDN.)

You can also configure replication between MFA servers - when you install the MFA server you can define whether it's primary or secondary. https://video2.skills-academy.com/en-us/azure/active-directory/authentication/howto-mfaserver-deploy-ha

Share via

HA for Azure MFA server

1 answer

Your answer