In this approach, YubiKeys are deployed in Azure MFA as an OATH Token. For Microsoft’s RADIUS implementation, the Network Policy Server (NPS) extension for Azure allows organizations to safeguard client authentication using cloud-based Azure Multi-Factor Authentication (MFA). Leveraging the Remote Authentication Dial-In User Service (RADIUS) protocol, Identity Providers (IDPs) interface with Cisco’s ASA to validate TOTP codes. This document focuses on a Microsoft Active Directory and Azure Active Directory centric implementation but the basic patterns can be applied to other vendor solutions.Īpproach 1: YubiKey TOTP with Azure AD and NPS ExtensionĪ common approach to provide multifactor authentication (MFA) is to use OATH Time-based One Time Passcodes (TOTP) as a second factor. This document outlines each approach and discusses each approach's advantages. Additionally, YubiKeys can be used for primary authentication without the need for a password with Smart Card or FIDO2 (SAML implementation) deployments. The YubiKeys can be used with TOTP (RADIUS and SAML implementations) for second factor authentication. There are many different approaches to implementing YubiKeys with Cisco VPN based on the ASA configuration. Cisco Adaptive Security Appliance (ASA) VPN deployments can take advantage of the strong authentication that YubiKeys provide.

Cisco anyconnect azure mfa