Hi Folks, with current Entra free, you can only do passwordless. I wonder if with nFactor, I could do passwordless and then do LDAP/next factor so no FAS required. What I am trying to achieve is be able to use Yubikey as a 2FA for some users. Other will still be able to use MS authenticator. And to make things more tricky, I need to keep current on-prems OTP setup working. So the flow would be user > group extraction > default OTP on-prems | if member of AD group do Azure entra. NetScaler will be SP and Entra free IDP. What do you use SAML or oAuth? Is there a strong consensus on what the future / std is? Last, if NS is a SP, does it need Internet connectivity? Can it use a proxy? Is DNS required (I'm not using it). Thanks!

NetScaler needs to be able to talk to the IDP as a SP, because it needs to request/validate the tokens, so it will require DNS as well. I’m not sure if you can use a proxy for that, perhaps when it is transparant.

Thanks @Jan Tytgat! So the only URLs required are the one I set for the IDP? No need to allow a range of URLs? I couldn't find a way to configure a proxy which is somehow surprising.

I don’t think limiting URLs is the way to go, as they might change when updating the endpoints at the IdP. But you should be able to limit outbound to a list of domains.

OK a list of domains, are you/all not doing something like this usually?

I don’t think I’ve had to use a proxy yet, no (at least not one that I had to configure)

I meant to ask is the NS IPs used for the communication or is it SNIP?

MSIP typically