How I can add MFA for non-corporate vpn users using Azure

[Daryaya]

Hi,

Currently we use AD configured as ldap server to authenticate our 3rd party vpn users who need to get to our network. for internal users, we configure Azure as radius server that can also offer MFA. I was wondering is there a way to use MFA for external users too as they don't have o365 account?

[xsilver_FTNT]

Hi Daryaya,

on FortiGate, if you configure not just LDAP server to the group, but set local users, remote type ('set type ldap' for e.g.), pointing to LDAP, and equip those on-FGT locally defined users with FortiToken. Then when they log in and pass user/password verification they should be prompted for the token. Keep in mind that AD is case insensitive, so older you could circumnavigate 2FA on old FortiOS by changing username used to not match exact case-sensitive setting on FortiGate, but newer FortiGates do have that handled with " set username-case-sensitivity disable" ;-) on FortiAuthenticator, you can sync users from that LDAP and let sync rules to assign tokens to those users completely automatically.