MFA NPS extension
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit c65d1d7 · +4 −2 lines · also on GitHub
⋯ 5 unchanged lines
66
ms.service: entra-id
77
ms.subservice: authentication
88
ms.topic: how-to
9
−ms.date: 10/04/2024
9
+ms.date: 12/05/2024
1010
1111
ms.author: justinha
1212
author: justinha
⋯ 261 unchanged lines
274274
If your previous computer certificate has expired, and a new certificate has been generated, you should delete any expired certificates. Having expired certificates can cause issues with the NPS Extension starting.
275275
276276
> [!NOTE]
277
−> If you use your own certificates instead of generating certificates with the PowerShell script, make sure that they align to the NPS naming convention. The subject name must be **CN=\<TenantID\>,OU=Microsoft NPS Extension**.
277
+> If you use your own certificates instead of generating certificates with the PowerShell script, make sure that they include the Client Authentication purpose and that the private key has **READ** permission granted to the user *NETWORK SERVICE*.
278
+> If you use version 1.2.2677.2 or earlier, the certificate must align to the NPS naming convention and the subject name must be **CN=\<TenantID\>,OU=Microsoft NPS Extension**.
279
+> If you use version 1.2.2893.1 or later, the certificate’s thumbprint can be used to identify the certificate. Set HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AzureMfa\CLIENT_CERT_IDENTIFIER to the thumbprint in **Registry Settings**. There have been issues with subject name lookup for some certificates. Using thumbprint works around this issue.
278280
279281
### Microsoft Azure Government or Microsoft Azure operated by 21Vianet additional steps
280282
⋯ 179 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 07:36 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.