FortiAuthenticator to Azure AD (Chained token authentication with remote RADIUS server)

[2pm]

Is there a way to send LDAP'd users from the FortiAuthenticator to our Microsoft NPS server for Azure MFA?

If we configure a realm for LDAP and Chain the token authentication with our Microsoft NPS Radius server, when a user connects to the FortiClient the token field appears. From there we type in something random, and it will send to our Radius server.

Is there a way to have it send the to our Radius without having to type in a random token?

[xsilver_FTNT]

Hi,

not sure I'm following. It seems to me that sending just anything to NPS gets you authenticated, is that right ?

I thought that chained 2FA is usually there to verify something like RSA token, where precise token OTP code is expected to match what RADIUS server does expect to see in specified time frame.

[2pm]

My original plan was to have to the FortiAuthenticator be the first authentication. After that 2FA will be from our NPS server, which is setup for our AzureMFA. I spoke with support and I was told that is not possible.

I next thing I wanted to do, import Remote Radius users and added them to a Radius group. From there create a Radius policy for only that Radius group. But I was told that I would have to add every learned radius user individually. So that defeat the automation process. 

If there is a way to automate adding Remote Radius users, that would solve all my issues with the FortiAuthenticator. Since all SSL-VPN authentication hit our FortiAuthenticator first, that I were I wanted to stop any unwanted users to pass.

My currently setup is all users get sent to our NPS and the NPS server does the filtering.