I believe I can do this with something called 'Group Lock', but this requires RADIUS AVP again, so I think I will just run into the caveat above again. My users will have to be trained to connect to the different profiles depending on the access they need.īut I need to configure FTD so that only certain users can login to each connection profile. So, now I think I need to create 2 separate VPN Connection Profiles (aka Tunnel Group), with each Profile getting the specific Group Policy applied as the default. This is a problem because I was trying to use Class 25 AVP to return the An圜onnect Group Policy I want the matching user to get. However, the NPS extension has a caveat regarding RADIUS AVP data being returned during certain MFA scenarios: If your user uses SMS or App Code verification methods, the RADIUS attributes you have setup in the NPS policy are not returned to the VPN appliance. When your devices are Hybrid Azure AD Joined, a valid MFA claim is included in the PRT and so your devices will always pass MFA and will never prompt for MFA for the user that is assigned to the Hybrid AAD Joined device.

I have this all working via the Microsoft NPS RADIUS server and the Azure MFA extension for NPS. So we have Cisco FirePower FTD appliances for VPN headend, but we need to use Microsoft Azure for MFA. Looking for some help I can't quite wrap my head around.sorry, it's a long story:

Cisco anyconnect azure mfa