Haxoris Wiki

Missing MFA On Remote Access

How Missing MFA On Remote Access works

Missing MFA on remote access is any reachable login a stolen password alone can complete, with no second factor demanded. The paths are the ones that carry the estate: SSL and IKEv2 VPN, RD Gateway and RDS web, SSH jump hosts, OWA and EWS webmail, ADFS and internal SSO, and standalone admin portals. MFA being present is not MFA being enforced on all of them, and the gap is usually a specific carve-out rather than a missing product.

The attacker who sprayed, phished or reused one password walks straight in on the path that does not enforce, and the enforced paths never see it. It survives because the gap is invisible from the front door: a dashboard shows “MFA on” as a tenant or appliance toggle while a legacy authentication flow behind it never invokes the factor. The usual holes are legacy protocols (IMAP, POP, SMTP and EWS basic auth cannot carry an interactive prompt), service-account and trusted-location exclusions that were meant to be temporary, users who are enabled but never enrolled and so remain password-only, and push fatigue where the factor exists but can be spammed until someone approves.

Missing MFA On Remote Access in practice

Enumerate the remote access paths

Catalogue the reachable login surfaces before testing any factor policy, so the enforcement matrix later is complete rather than sampled.

# Read-only: catalogue the reachable login surfaces
nmap -sV -Pn -n --open -p 443,3389,4443,993,995 \
  vpn.lab.internal rdg.lab.internal mail.lab.internal -oA /tmp/remote-paths

# Identify the webmail auth stack from headers and the logon redirect
curl -skI https://mail.lab.internal/owa/ | grep -i 'location\|server'

Test each path for second-factor enforcement

Use an authorised test account that has MFA enrolled, and attempt a password-only login on each path. Any path that returns a session without prompting for the factor does not enforce it. One attempt per path, no lockout risk taken.

# Modern-auth portal: a password-only POST should redirect to the MFA step
curl -sk -c /tmp/j.txt -d 'username=<TEST_USER>&password=<TEST_PW>' \
  https://vpn.lab.internal/api/logon -w '%{http_code}\n' -o /tmp/vpn.out

# Legacy EWS / basic auth: a 200 here is single factor by definition, because
# basic auth has no channel to carry an interactive second factor
curl -sk -u '<TEST_USER>:<TEST_PW>' https://mail.lab.internal/EWS/Exchange.asmx \
  -o /dev/null -w '%{http_code}\n'

Find the carve-outs in the policy itself

The bypass is usually written into the policy, not absent from it. Read the conditional access, ADFS or RADIUS policy read-only and flag every exclusion and legacy-auth allowance.

# Read-only: list conditional access policies and surface exclusions and any
# rule that still permits legacy clients. Requires Policy.Read.All.
Connect-MgGraph -Scopes "Policy.Read.All"
Get-MgIdentityConditionalAccessPolicy |
  Select-Object DisplayName, State,
    @{n='ExcludedUsers'; e={$_.Conditions.Users.ExcludeUsers}},
    @{n='ExcludedGroups';e={$_.Conditions.Users.ExcludeGroups}},
    @{n='ClientApps';    e={$_.Conditions.ClientAppTypes}} |
  Format-List
# On-prem equivalents: ADFS access-control policies and the NPS / RADIUS
# network policy behind the VPN - read those the same way.

Record enforcement per path, not per tenant

One estate has many paths and a single tenant-wide indicator hides the exceptions. Classify each path so the remediation list names the exact door.

access path            second factor?   how it fails
---------------------  ---------------  ---------------------------------------
SSL VPN portal         yes (TOTP)       enforced
IPsec / IKEv2 VPN      no               password plus a shared group secret only
RD Gateway (web)       conditional      skipped from the trusted office range
OWA (modern auth)      yes              enforced
EWS / ActiveSync       no               basic auth, cannot carry a factor
SSH jump host          no               key or password, no second factor
ADFS admin app         no               excluded group svc-reporting

Any “no” row is a password-only remote entry regardless of a tenant-wide “MFA: on” indicator, and each is a finding in its own right.

How to fix and prevent Missing MFA On Remote Access

  1. Enforce phishing-resistant MFA on every remote and admin path
    • Inventory the paths first, then require a second factor on each - VPN, RD Gateway, jump hosts, webmail and every admin portal.
    • FIDO2 or certificate-based factors beat push and one-time codes, which phishing and fatigue defeat.
  2. Block legacy authentication outright
    • Basic auth on EWS, ActiveSync, IMAP, POP and SMTP cannot carry an interactive factor, so any of these left enabled is a single-factor bypass of the whole policy.
  3. Remove standing carve-outs
    • Delete trusted-location bypasses and permanent user or service-account exclusions.
    • Where an exception is genuinely unavoidable, time-box it, scope it to one application, and give it a named owner.
  4. Enrol every user and block the unenrolled
    • An enabled account with no registered method is password-only; drive enrolment from a secure registration flow and deny access until a factor exists.
  5. Blunt push fatigue
    • Turn on number matching, cap prompt volume, and alert on repeated denials followed by an approval, which is the signature of a user worn down into accepting.

Last updated

References