Hi folks, who is using the nps extension for Azure mfa with for the citrix gateway authentication? We noticed by chance that users that NOT have configured mfa in entra, can now access on the citrix gateway only with user and pw. Before an recent update, the users got an error, but now radius let them access: Access Accepted for user xxxx@domain.com with Azure MFA response: NoDefaultAuthenticationMethodIsConfigured. We tried to enable the Message-Authenticator attribute as written in KB5040268 but after this, the Authentication RADIUS Server on the netscaler answers that the radius server isn't configured properly. Has anyone else observed this and found a solution for it?

What version of NetScaler are you using? we have the NPS extension configured but havnt updated to the latest version of 13.1 yet.

13.1 55.34

We are running 53.24 and seems to be okay.

This is different from the (EOL’d) Azure MFA server?

didn't find nothing in the changelogs or the known issues. maybe someone already installed the 56.18 can check it?

@Kari Ruissalo (WyW) Yeah at least for us we are using the Azure NPS extension not the Azure MFA Server.

do you have flagged this setting on the NPS?

No we dont have that option ticked

ok without that option it works also for us 😉 but without this option users without mfa configured can authenticate with user and pw, but should be blocked

That is strange, I have tested it with a user with no MFA enrolment and they dont get through.

this was always also forus, but an update of either netscaler or nps extension must have changed this behavior unfortunately

Looking at the comments from James Rankin on an MFA issue he has seen with the newest version we might hold off on the upgrade. Looks like Citrix will have a fix for it in Jan, not sure if it directly relates to NPS extension but he mentioned issues with SAML/MFA on the newest version.

13.1 55.34 here with NPS extension 1.2.2131.2 , don't have the option ticked and everything working as it should

@Lucas Van den Broeck so users that don't have mfa configured are blocked on citrix gw?

@saimen: correct, tested with a few just to be sure

what version of nps extension are you using? I'm pretty sure it must be related to that,

specified that in my previous reply : 1.2.2131.2, so for sure not the most recent one, but nothing in the release notes to make us upgrade atm

we have the 1.2.2893.1 installed but we saw just now that we have another customer, with exactly the same extension version where users without mfa are blocked. so it could be related also to different settings on the tenantside