I need to set up conditional access policies that would govern MFA access to a VPN

Question

I need to set up conditional access policies that would govern MFA access to a VPN

Andy Heckman 0

I want to use Unifi Fabrics to deploy VPN and WiFi securely to end users. Currently it allows users to authenticate but the MFA does not work through SAML.

VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-02-17T18:55:09.2466667+00:00
Hello Andy Heckman,

UniFi VPN currently supports SAML authentication with Microsoft Entra ID for primary sign‑in, but it does not support interactive MFA challenges during VPN connection establishment. Due to this limitation, Microsoft Entra ID Conditional Access policies that require MFA cannot be enforced for UniFi VPN connections over SAML. This behavior is expected and is a platform limitation on the UniFi VPN side, not a Conditional Access misconfiguration.

To enforce MFA for VPN access, the supported approaches are:

UniFi UID Adaptive VPN, which enforces MFA natively before the VPN tunnel is established, or

RADIUS‑based authentication with MFA (for example, RADIUS with Duo or Microsoft Entra MFA via NPS), which allows MFA enforcement at the authentication layer

https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-mfa
VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-02-18T04:35:40.3566667+00:00

Andy Heckman I’m following up on my previous comment as I haven’t received a response. Please let me know if you need any additional information or assistance from my side.
Philipp Kahler 80 Reputation points

2026-02-24T08:57:31.1833333+00:00

Hey guys,

What's the situation with WiFi? Can I use conditional access here? Or is that a problem with VPN AND WiFi?
VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-02-24T18:16:31.2033333+00:00

Philipp Kahler It’s the same situation for Wi‑Fi as well. If UniFi Wi‑Fi is using SAML with Microsoft Entra ID, Conditional Access policies that require MFA cannot be enforced during the Wi‑Fi connection. This is an expected limitation with SAML.

So yes, this applies to both VPN and Wi‑Fi. To enforce MFA, you’d need RADIUS (NPS + Entra MFA) or certificate‑based (EAP‑TLS) authentication instead of SAML.

Your answer

VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-02-17T18:55:09.2466667+00:00

Hello Andy Heckman,

UniFi VPN currently supports SAML authentication with Microsoft Entra ID for primary sign‑in, but it does not support interactive MFA challenges during VPN connection establishment. Due to this limitation, Microsoft Entra ID Conditional Access policies that require MFA cannot be enforced for UniFi VPN connections over SAML. This behavior is expected and is a platform limitation on the UniFi VPN side, not a Conditional Access misconfiguration.

To enforce MFA for VPN access, the supported approaches are:

UniFi UID Adaptive VPN, which enforces MFA natively before the VPN tunnel is established, or

RADIUS‑based authentication with MFA (for example, RADIUS with Duo or Microsoft Entra MFA via NPS), which allows MFA enforcement at the authentication layer

https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-mfa
VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-02-18T04:35:40.3566667+00:00

Andy Heckman I’m following up on my previous comment as I haven’t received a response. Please let me know if you need any additional information or assistance from my side.
Philipp Kahler 80 Reputation points

2026-02-24T08:57:31.1833333+00:00

Hey guys,

What's the situation with WiFi? Can I use conditional access here? Or is that a problem with VPN AND WiFi?
VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-02-24T18:16:31.2033333+00:00

Philipp Kahler It’s the same situation for Wi‑Fi as well. If UniFi Wi‑Fi is using SAML with Microsoft Entra ID, Conditional Access policies that require MFA cannot be enforced during the Wi‑Fi connection. This is an expected limitation with SAML.

So yes, this applies to both VPN and Wi‑Fi. To enforce MFA, you’d need RADIUS (NPS + Entra MFA) or certificate‑based (EAP‑TLS) authentication instead of SAML.