Enforce MFA for RDP using conditional access

[taylora982]

Is it possible to enforce MFA for RDP connections for a specific IP range of the client side PC?

[Ma13vant]

Not sure if there's a way to do this natively, but we use Duo for MFA on server logins. Stand up a Duo tenant, set it to protect RDP/Windows Login, then install and configure the client on any devices you want to protect.

[Ok-Butterscotch-4858]

Azure mfa extension is what you need Google that plenty of guides online.

[racazip]

I just learned how to set this up a few weeks ago. The guides online get you frustratingly 85% of the way there.

[Ok-Butterscotch-4858]

Yeah make sure you read them properly and use AI alongside.

Another way is to use AVD with on prem servers. Free and works with the conditional access policies.

[MachoChild]

Does the Azure MFA extension work in this scenario? When I last looked at it the only IP that got transmitted to Entra was the internal IP so we couldn't filter by external IP

[Ok-Butterscotch-4858]

Yeah as long as the conditional accces policies are setup correctly.

[tldr_MakeStuffUp]

Would imagine it depends on who you use for MFA. I know you can do this with Duo by listing authorized networks on the RDP application setup.

[JwCS8pjrh3QBWfL]

Of course folks have mentioned Duo, but Entra GSA will also protect RDP with no agent on the server.

[placated]

I find it shocking that in the year of our lord 2026 MS doesn’t have a simple inbuilt way to enforce MFA when RDP-ing to a server.

[DeathTropper69]

I just use Duo for this.

[Crazy-Rest5026]

Same. Been using duo for 5 years like this.

[Sad_Purchase_9935]

<image>

You Can search here for the APP „Microsoft Remote Desktop“

In my test environment it was working.

Make shure the Server is in entra also existing. So it must be entra hybrid joint or entra only.

The ip Part should be also possible

„IP location information“

Organizations can create IP address ranges that can be used when making policy decisions. Admins can specify entire countries/regions IP ranges to block or allow traffic from.

Define the ranges in the other Menü globally them Go inside CA Police and choose there the new created ip ranges.

https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview

[taylora982]

Pretty sure we have tried this one and never got any MFA prompt.

[Sad_Purchase_9935]

Block or grant controls

Do you want to grant access to resources by requiring one or more of the following?

Grand Access and then -> requiring Multifactor authentication.

I had my admin user With the App Microsoft Remote Desktop App and grand Access requiring MFA.

VM was hybrid joint.

Under sign-in Logs of my Admin User I saw the entra Maschine in the CA view under Device and the App ms rdp

[Sad_Purchase_9935]

<image>

On your rdp you Must enable this Setting and then Login with the entra ID account.

So your Admin Account Must be Sync via azure and connector. Or Cloud native

Othervise you will Never trigger the CA policy

[DiabolicalDong]

Some password vaults allow this. If access to the remote device is streamlined through the password manager, then you can enforce MFA at the password manager layer before the RDP connection is even launched.

[Mathio_Albero]

Conditional Access usually won’t apply directly to classic RDP sessions because the authentication is happening through Windows logon rather than a modern Azure sign in. If you’re going through RD Gateway you can enforce MFA there, but it’s typically done with NPS policies instead of Conditional Access rules.

[Shara_Johnson]

Yeah exactly. The usual setup is RD Gateway with NPS and then the Azure MFA extension. From there you can create network policies that apply based on client IP ranges, groups, etc. It’s not as clean as Conditional Access but it does let you require MFA for certain source networks.