How to Fix TLS 1.2 Credential Prompts in Azure MFA Server
Question details
Users need to resolve an issue where Azure Multi-Factor Authentication Server repeatedly requests credentials without sending the actual MFA prompt.
- Product
- Azure Multi-Factor Authentication Server
- Device & OS
- not provided
- Scenario
- Accessing services protected by Azure MFA when TLS 1.2 is enabled on a Cisco ASA firewall.
- Observed behavior
- The server repeatedly prompts the user for their credentials but fails to trigger or send the expected MFA prompt to the user.
Ensure you have administrative access to your Azure MFA Servers, your network load balancer, and confirm that you have created a secure backup of the MFA Server configuration data file before beginning the upgrade process.
Upgrade Azure MFA Server to the Latest Version
Performing an in-place upgrade of your Azure MFA Server resolves the compatibility and authentication loop issues caused by TLS 1.2 on Cisco ASA firewalls.
To maintain high availability and prevent downtime, the upgrade must be performed in a specific sequence. Subordinate servers should be taken out of the load balancer and upgraded first, followed by the primary server.
Locate and securely back up the Azure MFA Server data file to a safe directory or external drive to prevent data loss.
Access your network load balancer settings and temporarily remove the subordinate MFA servers from the active pool.
Run the latest Azure MFA Server installer on the isolated subordinate servers. Ensure you install the required Visual C++ redistributables if prompted during the installation.
If your infrastructure utilizes the Web Service SDK, run its update process on the newly upgraded subordinate servers.
Once all subordinate servers are successfully upgraded and functioning, repeat the in-place upgrade process on the primary Azure MFA Server.
Need a Reliable Office Suite for Your IT Documentation?
While managing server infrastructure and firewall configurations, having a robust and lightweight tool for your IT documentation is essential. WPS Office provides a comprehensive, free office suite perfectly suited for drafting network topologies, server upgrade logs, and technical manuals.
- 1. Visit the official site: Go to the official WPS Office website using your web browser.
- 2. Download the software: Click on the Free Download button to get the installer for your operating system.
- 3. Install and launch: Run the setup file and follow the on-screen instructions to start managing your IT documents effortlessly.
Frequently Asked Questions
Why does TLS 1.2 cause credential loops with Azure MFA and Cisco ASA?
Older versions of Azure MFA Server may not fully support the strict TLS 1.2 handshake requirements enforced by certain Cisco ASA configurations, causing the authentication sequence to restart instead of advancing to the second-factor prompt.
Can I upgrade the primary MFA server first?
It is highly recommended to upgrade the subordinate servers first while they are temporarily removed from the load balancer. Upgrading the primary server last ensures that configuration replication and system availability remain uninterrupted.
Will an in-place upgrade overwrite my existing MFA configurations?
No, the Azure MFA Server installer is designed to perform an in-place upgrade. It retains your existing server configurations, settings, and data files. However, creating a manual backup before upgrading is still highly recommended.
