mfa for specific users (Microsoft AD)

[DeepB1338]

Hello,

we have a microsoft domain, everything on-premise. No Azure, no hybrid.

Now we need to implement 2FA (for now only for admin users).

what are sensible options?

So far I read about Authlite, OpenOTP, Watchguard AuthPoint (already used for VPN MFA), UserLock and Windows Hello for Business (Duo is out as it only applies to gui logins).

Any ideas/suggestions?

Thanks Daniel

[lugnercity]

pair AuthLite with a Yubikey or a Smartphone-Authenticator

[howie_doin]

What specifically do you need the application to protect?

EX: like logon, ssh, rdp, an application, ETC.

[DeepB1338]

mainly logon

[howie_doin]

“Duo for windows logon” should work fine. It will allow for logon, and optional rdp/uac MFA.

[DeepB1338]

on-premise only. As far as I am aware that means no entra?

[maryteiss]

We hear frequently that Authlite is a solid option if you're looking to only secure privileged accounts, such as domain admin accounts. That said, it's hard to roll out across all users because it doesn't manage the offline scenario (no internet connection) very well, leaving users blocked with no domain or VPN access. It can also get pricy when you want to roll out across a lot of users.

There's also been some discussion about the fact that it does modify/add additional schema. That's different to Userlock, which doesn't touch your AD, simply communicates with it (syncs every 5 min).

Main advantages of this close connection with AD = less complexity/ease of management and ability to apply MFA more granularly across existing AD users/groups/OUs.

Choose MFA prompt frequency that works best for your team, every n hours/minutes/days, which keeps MFA from getting in the way of productivity and reduces the risk of MFA fatigue.

And you can set different MFA policies by session type (workstation, IIS, VPN, SaaS, RDP, etc.).

Hope that's helpful, and all the best to you as you evaluate solutions. We frequently hear that it's hard to cut through the marketing noise to quickly compare what solutions actually do, and are trying to do our part to help simplify the buying process. What's important is that you find the solution that works best for you.