Overview of Entra ID MFA
Entra ID MFA integrates Microsoft Entra ID with Ivanti Access to provide external multi-factor authentication for Microsoft applications. When Microsoft Entra ID requires additional authentication, Ivanti Access evaluates the assigned policy and prompts users to authenticate using one of the configured authentication methods.
Entra ID MFA includes:
- Support for multiple authentication methods.
- Dedicated MFA policies for evaluating authentication requests.
- Integration with Microsoft Entra ID External MFA.
- Reporting capabilities for authentication activity and policy evaluations.
Supported authentication methods
Entra ID MFA supports the following authentication methods:
- QR Code
- Push Notifications
- One-Time Passcodes (OTP)
- Tunnel Authentication
Required components
Deploying Entra ID MFA requires the following components:
- Ivanti Access
- Microsoft Entra ID with at least a P1 license
- A registered application in Microsoft Entra ID
- An External MFA provider configuration in Microsoft Entra ID
- Ivanti Neurons for MDM, to configure Ivanti Go on user devices
- User devices must be managed by Ivanti Neurons for MDM, with the configuration for each authentication method pushed to the device:
- Tunnel Authentication: Push the Ivanti Tunnel VPN configuration.
- QR Code, Push Notification, and OTP: Do one of the following:
- Push the Zero Sign-On (SaaS) configuration.
- Enroll the device in Auth-Only mode and push the authenticator Only configuration. Tunnel Authentication is not supported in Auth-Only mode.
For more information, see Configuring Ivanti Access in Ivanti Neurons for MDM, Configuring Ivanti Tunnel in Ivanti Neurons for MDM and Configuring Zero Sign-on in Ivanti Neurons for MDM.
- Ivanti Go for QR Code, Push, and OTP authentication
- Ivanti Tunnel (required only for Tunnel Authentication; not supported in Auth-Only mode)
- An Entra ID MFA integration in Ivanti Access
- A Conditional Access policy in Microsoft Entra ID that requires MFA
Entra ID MFA policies
Entra ID MFA uses dedicated MFA policies to evaluate authentication requests received from Microsoft Entra ID. MFA policies are separate from conditional access policies in Ivanti Access; to use Entra ID MFA, you must configure an MFA policy.
Supported policy rules include:
- Tunnel App
- Standard Tunnel Rule
- Untrusted Apps Rules
- Network Rule
- Advanced Network Rule
- User Info Rule
- Request Header Rule
- App ID Rule
- Device Ownership Rule