The recommended solution is to use a Network Policy Server (NPS) with the Azure AD Multi-Factor Authentication extension. The on-premises VPN server, acting as a RADIUS client, sends authentication requests to the NPS. The NPS extension then communicates with Azure AD to enforce the user's MFA policy, providing a second factor of authentication. This architecture allows organizations to secure their existing RADIUS-based authentication infrastructure, such as VPNs, with cloud-based Azure MFA without replacing the core hardware. The primary authentication still occurs against the on-premises Active Directory.

A. Azure AD Application Proxy: This service is designed to publish on-premises web applications for secure remote access, not for integrating MFA with RADIUS clients like a VPN server.

B. an Azure AD Password Protection proxy: This component extends Azure AD's custom banned password lists and smart lockout features to an on-premises Active Directory. It does not provide MFA.

D. a pass-through authentication proxy: This is an Azure AD Connect agent that validates user passwords directly against on-premises Active Directory for sign-in. It is not a RADIUS proxy for MFA.

---

1. Microsoft Learn. "Integrate your existing Network Policy Server (NPS) infrastructure with Azure AD Multi-Factor Authentication." Microsoft Entra Documentation. This document explicitly states

"The NPS extension for Azure AD MFA adds cloud-based MFA capabilities to your on-premises infrastructure... The NPS extension acts as an adapter between RADIUS and cloud-based Azure AD MFA to provide a second factor of authentication for... users." It includes a diagram showing a VPN server as a RADIUS client connecting to an NPS server with the extension.

2. Microsoft Learn. "Plan an Azure AD Multi-Factor Authentication deployment." Microsoft Entra Documentation. In the section "Choose your authentication methods

" it details using the NPS extension for on-premises applications: "For on-premises apps that use RADIUS authentication

the best option is to deploy an NPS server with the Azure AD MFA NPS extension."

3. Microsoft Learn. "What is Application Proxy?" Microsoft Entra Documentation. This source clarifies the purpose of Application Proxy: "Azure Active Directory's Application Proxy provides secure remote access to on-premises web applications." This confirms it is not suitable for RADIUS/VPN authentication.

4. Microsoft Learn. "Deploy on-premises Azure AD Password Protection." Microsoft Entra Documentation. This document describes the role of the proxy service as part of the Password Protection feature

which is unrelated to providing MFA for authentication requests.