Extending Azure MFA NPS Extension – Wi-Fi (WPA Enterprise) & VPN (Cisco Meraki)

Question

Extending Azure MFA NPS Extension – Wi-Fi (WPA Enterprise) & VPN (Cisco Meraki)

Luis Barrera 1

Hello

I’m currently testing the Azure MFA NPS extension in two scenarios:

Wi-Fi authentication using WPA Enterprise
VPN authentication connecting to Cisco Meraki

My NPS setup works fine and users can connect smoothly. However, once I extend it with Azure MFA NPS, issues begin to appear.

I ran the troubleshooting PowerShell script and all tests passed successfully: https://github.com/Azure-Samples/azure-mfa-nps-extension-health-check.

The part I’m trying to understand is the expected behavior for Wi-Fi authentication using AD credentials. Should I be seeing an MFA prompt during Wi-Fi sign-in? Because in my testing, that step doesn’t trigger MFA at all.

Looking at Event Viewer, I see this entry:

*NPS Extension for Azure MFA: NPS Extension for Azure MFA only performs Secondary Auth for Radius requests in AccessAccept State. Request received for User *****@contoso.com with response state AccessChallenge, ignoring request.

Additional context:

The user has an Entra P1 license assigned. No Intune related because investments are only focus on Entra for SSO, Conditional Access etc.

The test device is not domain-joined (I’m deliberately testing on a non-domain joined device first).

My Questions

For Wi-Fi authentication with AD credentials, should I expect an MFA prompt?

Is the AccessChallenge state the reason MFA isn’t triggered in this scenario?

Any guidance on how this behavior is intended to work would help clarify things.

0 comments

1 answer

Your answer

Answer 1

For WPA-Enterprise Wi-Fi and VPN with the Azure MFA NPS extension, MFA is only performed on RADIUS requests that reach AccessAccept state on NPS. Requests in AccessChallenge state are explicitly ignored by the extension, which matches the event log message being observed.

The NPS extension behavior is:

It hooks into NPS as an authorization extension.
It only performs secondary authentication (MFA) when NPS has already decided to accept the request (RADIUS AccessAccept).
If the RADIUS conversation is still in an AccessChallenge state (for example, EAP/PEAP inner authentication steps, certificate negotiation, or other challenge/response flows), the extension does not run MFA yet and logs the message seen:

"NPS Extension for Azure MFA only performs Secondary Auth for Radius requests in AccessAccept State. Request received ... with response state AccessChallenge, ignoring request."

So, in the Wi-Fi scenario:

If the RADIUS flow for WPA-Enterprise is ending in AccessChallenge (for example, due to EAP method behavior or additional inner challenges), the NPS extension will not trigger MFA at that point.
MFA will only be invoked once NPS produces a final AccessAccept for that authentication.

Regarding expectations:

There is no special behavior in the NPS extension that treats Wi-Fi (WPA-Enterprise) differently from VPN. Both are just RADIUS clients from the NPS perspective.
Therefore, yes, MFA can be enforced for Wi-Fi using AD credentials, but only when the NPS policy evaluation completes and the RADIUS response is AccessAccept.
The log entry confirms that, in the current flow, the extension is seeing an AccessChallenge response and is correctly skipping MFA at that stage.

To get MFA to trigger for Wi-Fi:

Ensure that the NPS policy for the Wi-Fi RADIUS client completes with AccessAccept (no remaining EAP challenges) and that the request then passes through the NPS extension.
Once the final response is AccessAccept, the extension will perform secondary authentication (MFA) as designed.

In summary:

Yes, MFA is supported and can be expected for Wi-Fi (WPA-Enterprise) using AD credentials when the RADIUS request reaches AccessAccept.
Yes, the AccessChallenge state in the event log is the reason MFA is not being triggered at the point being observed; the extension intentionally ignores non-AccessAccept states.

References: