This blogpost details how to setup and configure Microsoft’s on-premises Azure Multi-factor Authentication (MFA) Server product in an existing environment.

It details how to install and configure the base components: The MFA Server, the Web Service SDK and the User Portal.

Before you begin

Before you begin, you should have access to the following information:

• The DNS domain name of your organization’s Active Directory Domain Services (AD DS) environment
• Credentials for an account that is a member of the Domain Admins group in Active Directory
• Credentials for an account that has the Global administrator role assigned in Azure AD

Of course, it’s a good idea to make a back-up of your Domain Controllers and test one of the backups in a separate networking environment to make sure you’re able to restore.

Overview

The implementation performed, resembles the Stretched deployment in terms of the supported Azure MFA Server deployment scenarios, discussed earlier:

Requirements

For this scenario, two Windows Server installations are needed:

1. MFA1 – This server becomes the Azure MFA Back-end Server (Master)
2. WEB1 – This server becomes the Azure MFA Web Server

These servers will have to have .NET Framework 4 installed and be made members of an existing Active Directory environment. For the purpose of this blogpost, two Windows Server 2016-based installations will be deployed.

Microsoft disabled the ability to create MFA Providers in Azure AD per September 1^st, 2018. If you haven’t registered an MFA Provider before this date, all user accounts in scope for MFA Server need to be synchronized from Active Directory to Azure AD. The easiest way to do this, is using Azure AD Connect with Express Settings. Afterward, Azure AD Premium (P1) licenses need to be assigned to them (or an overarching license that includes this license, like Azure AD Premium Premium (P2), or Microsoft 365 E3)

As part of basic information security, traffic to the MFA User Portal and to the MFA Web Service SDK is encrypted. For this purpose, we will need valid TLS certificates. Install corresponding TLS certificates in the Personal stores of the Local Machine on both MFA1 and WEB1.

Download MultiFactorAuthenticationServerSetup.exe from the MFA Server download page and place it on the disks of server MFA1.

Step 1: Install and configure MFA Server on MFA1

The Central MFA Server component communicates with the cloud-based MFA Point of Presence (PoP) to perform authentications and with on-premises systems like RADIUS clients and Domain Controllers.

Perform the following steps to install and configure Microsoft’s on-premises Azure Multi-factor Authentication (MFA) Server product on Windows Server MFA1:

1. Sign into Windows Server MFA1, using an account that is a member of the Domain Admins group and assigned local administrative privileges on the server.
2. Open File Explorer.
3. Navigate to the folder where you’ve placed the Azure MFA Server installation files:
4. Double-click MultiFactorAuthenticationServerSetup.exe.
5. In the Open File – Security Warning pop-up window, click Run.
6. In the Multi-Factor Authentication Server pop-up window (depicted above), click Install to install the Visual C++ “14” Runtime Libraries.
7. For Microsoft Visual C++ 2017 Redistributable (x86), select the I agree to the license terms and conditions option and click Install afterward. Click Close when setup is successful.
8. Repeat the above step for the x64 package.
   The Multi-factor Authentication Server screen will appear.
   (This may take a while…)
9. On the License Agreement page, select the I Agree option.
10. Click Next >.
11. On the Select Installation Folder page (see above), click Next >.
12. On the Installation Complete page, click Finish.

    The Multi-Factor Authentication Server management user interface appears, as depicted above.

13. The first thing to configure is the activation of the MFA Server, as the Activate screen is shown. Here, we have to enter activation credentials. On server MFA1, or on an Internet-connected workstation, perform the following actions to create the activation credentials:
    1. Open a web browser and navigate to the Azure Portal.
    2. Sign in with an account that has the Global administrator role assigned.
       Perform Azure-based multi-factor authentication, when prompted.
    3. In the left navigation menu, click Azure Active Directory.
    4. In the Azure AD navigation menu, scroll down to the Security section.
    5. Click MFA.
    6. In the scenario where an MFA Provider is present:
       1. In the Multi-Factor Authentication navigation menu, click Providers.
       2. Select a provider in the list of MFA providers to open its settings.
       3. In the navigation menu for the MFA Provider, click Server Settings.
       4. In the MFA Provider’s Server Settings, follow the Generate link.
    7. In the scenario of Hybrid Identity:
       1. In the Multi-Factor Authentication navigation menu, click Server settings.
       2. Follow the Generate link.
14. Copy the generated activation credentials into the Multi-Factor Authentication Server management user interface.
15. Click Activate within 10 minutes of generating the credentials, as the credentials automatically expire after this time period.
16. In the Multi-Factor Authentication Server pop-up window (depicted above), click Yes to enable and configure replication by running the Multi-Server Configuration Wizard.

    The Multi-Server Configuration Wizard appears (see the above screenshot).

17. On the Enable Replication Between Servers, click Next >.
18. On the Secure Communication page, unselect the Certificates option.
19. Click Next >.
20. On the Active Directory page, click Next >.
21. On the Multi-Server Configuration Complete page, click Finish.

The server will reboot.

Step 2: Configure AD Sync on MFA1

The central MFA Server component uses its own database to store information on user objects. The best approach in a Microsoft-oriented environment is to configure automatic synchronization of user objects from Active Directory to MFA Server’s phonefactor.pfdata database.

After installation and reboot, perform these steps on Windows Server MFA1 to configure Active Directory synchronization:

1. Sign into Windows Server MFA1, using an account that is a member of the Domain Admins group and assigned local administrative privileges on the server.
2. Open the Multi-Factor Authentication Server management user interface from the Start Menu.
3. In the left icon pane, select Directory Integration.
4. Navigate to the Synchronization tab:
5. On the Synchronization tab, enable the Enable synchronization with Active Directory option. Additionally, enable the Remove users no longer in Active Directory option.

Step 3: Configure the Web Service SDK on MFA1

To allow other MFA Server components, like the MFA User Portal and the MFA AD FS Adapter, to communicate with the central MFA Server component, install and configure Internet Information Services (IIS) and the Web Service Software Development Kit (SDK) on Windows Server MFA1:

1. Open an elevated PowerShell window, and execute the following line of PowerShell:Install-WindowsFeature Web-WebServer,Web-Http-Redirect,
   Web-Basic-Auth,Web-Asp-Net45,Web-Metabase -IncludeManagementTools
2. Close the PowerShell window.
3. Open the Multi-Factor Authentication Server management user interface from the Start Menu.
4. In the left icon pane, select Web Service SDK.
5. Click the Install Web Service SDK… button.

   The Multi-Factor Authentication Web Service SDK window appears (see above).

6. On the Select Installation Address click Next >.
7. On the Installation Complete page, click Close.
8. Close the Multi-Factor Authentication Server management user interface.

Step 4: Create the Web Service SDK service account and configure the service

To accommodate authentication to the Web Service SDK, a service account is needed, that is also a member of the PhoneFactor Admins group. Then, the Web Service SDK Application Pool needs to be configured with this service account.

Perform these steps on a Domain Controller, a domain-joined Windows Server with the Active Directory Domain Services Remote Server Administration Tools (RSAT) or a domain-joined Windows installation with the Remote Server Administration Tools (RSAT) installed:

1. Use an account that is a member of the Domain Admins group, or has delegated permissions to create user objects in Active Directory.
2. Open the Active Directory Administrative Center from the Start Menu.
3. At the top of the left navigation menu, switch to Tree view.
4. Navigate to the Users container.
5. In an empty space, right-click and select New, then User from the context menu.

   The Create User: window appears, as depicted above.

6. Type a Full name: and User SamAccountName: for the service account.
7. Type the password for the service account twice.
8. Select the Other password options option, and select Password never expires.
9. Select the Protect from accidental deletion option.
10. Scroll down to the Member Of section.
11. Click the Add… button.

    The Select Groups pop-up window appears (see above).

12. Type the PhoneFactor Admins group.
13. Click Check Names.
14. Click OK.
15. Click OK to create the service account.
16. Sign out.

Perform the following steps on Windows Server MFA1:

1. Sign into Windows Server MFA1, using an account that is a member of the local administrators group.
2. Open the Internet Information Services (IIS) Manager from the Start Menu.
3. In the left navigation menu of IIS Manager, expand the Sites node.
4. Select the Default Web Site.
5. In the Actions pane to the right, click Bindings….
6. In the Site Bindings pop-up window, click Add…
7. In the Add Site Binding add a binding for https. Select the appropriate TLS certificate and click OK.
8. Back in the Site Binding window, click Close.
9. In the left navigation menu of IIS Manager, expand the Application Pools node.
10. In the main pane, select the MultiFactorAuthWebServiceSDK application pool.
11. In the Actions pane on the right, click Advanced Settings…
12. From the list of settings, under Process Model, select Identity.
13. Click the button with the three dots to the right of ApplicationPoolIdentity.The Application Pool Identity window appears.
14. Select Custom account.Click Set….

    

    The Set Credentials pop-up window appears (see above).

15. Enter the User name: of the Web Service SDK service account in the format DOMAIN\ServiceAccount.
16. Enter the password for the service account twice.
17. Click OK.
18. Click OK.
19. Click OK.
20. Close Internet Information Services (IIS) Manager.

The Web Service SDK is now available via the following url: https://mfa1.domain.tld/multifactorauthwebservicesdk/

Step 5: Install the User Portal on WEB1

The MFA Server User Portal allows administrators, delegated service desk personnel and end-users to modify MFA settings and preferences. The User Portal will be installed on a separate Windows Server-based web server: WEB1.

Perform the following steps on Windows Server MFA1 to get the Multi-Factor Authentication Server User Portal Installer to Windows Server WEB1:

1. Open File Explorer.
2. Navigate to the installation folder of MFA Server. By default, this location is:
   C:\Program Files\Multi-Factor Authentication Server\
3. Copy MultiFactorAuthenticationUserPortalSetup64.msi.
4. Paste the Multi-Factor Authentication Server User Portal Installer on the disk of Windows Server WEB1.
5. Close File Explorer.
6. Sign out.

Perform these steps to install MFA Server’s User Portal on Windows Server WEB1:

1. Sign into Windows Server WEB1, using an account that is a member of the local administrators group.
2. Open an elevated PowerShell window, and execute the
   following line of
   PowerShell:Install-WindowsFeature Web-WebServer,Web-Asp-Net45,Web-Metabase -IncludeManagementTools
3. Close the PowerShell window.
4. Open File Explorer.
5. Navigate to the folder where you’ve placed the Multi-Factor Authentication Server User Portal Installer
   file:
6. Double-click MultiFactorAuthenticationUserPortalSetup64.msi.

   The Multi-Factor Authentication User Portal appears (see above).

7. On the Select Installation Address page, click Next >.
8. On the Installation Complete page, click Close.
9. Open the Internet Information Services (IIS) Manager from
   the Start Menu.
10. In the left navigation menu of IIS Manager, expand
    the Sites node.
11. Select the Default Web Site.
12. In the Actions pane to the right, click
    Bindings….
13. In the Site Bindings pop-up window, click Add…
14. In the Add Site Binding add a binding for https. Select the appropriate TLS certificate and click OK.
15. Back in the Site Binding window, click Close.
16. Close Internet Information Services (IIS) Manager.
17. Switch to the File Explorer window.
18. Navigate to the file location with the User Portal files. By default, this location is:
    C:\inetpub\wwwroot\MultiFactorAuth
    
    
19. Open Web.Config in Notepad.
20. In the appSettings section, make four changes:
    1. On line 9, change the value for USE_WEB_SERVICE_SDK from "false" to "true".
    2. On line 10, add the domain name and username for the service account that runs the application pool of the Web Service SDK, i.e. DOMAIN/Svc_MFASDK.
    3. On line 11, add the password.
    4. On line 60, in the ApplicationSettings section, change https://www.contoso.com/MultiFactorAuthWebServiceSdk/PfWsSdk.asmx
       to the url of the Web Service SDK, i.e. https://mfa1.domain.tld/multifactorauthwebservicesdk/PfWsSDK.asmx
21. From Notepad’s File menu, select Save.
22. From Notepad’s File menu, select Exit.
23. Close File Explorer.
24. Sign out.

The MFA User Portal is now available via the following url:
https://web1.domain.tld/multifactorauth

Concluding

Having written how to install and configure MFA Server 6.3 on 4Sysops.com four years ago, I’m amazed how much easier it is today to install Microsoft’s on-premises Azure Multi-Factor Authentication (MFA) Server, today.

Related blogposts

Supported Azure MFA Server Deployment Scenarios and their pros and cons
Connecting to Azure MFA Server’s Web Service SDK using certificate authentication
Choosing the right Azure MFA authentication methods
Azure Multi-Factor Authentication Server 8.0.1.1 was released