Change VPN client authentication option

[Ruan_Kotze]

Hi CheckMates,

We are transitioning our VPN to authentication via Entra, primarily to enforce MFA.

My question relates to migrating the client settings. Is there a way to accomplish this by manipulating the Authentication settings on the gateway? What I have done is made the MFA option the first priority in the Multiple Authentication Options list.

On the client side this results in the MFA option being labelled as the default, but it seems that regardless of that the client just uses the last succesful authentication method.

Is there anything we can do to flip the clients over to the MFA login option without needing to touch the client?

Thanks,
Ruan

[PhoneBoy]

You're using SAML, correct?
As I recall, this requires deleting and re-adding the site.

[Ruan_Kotze]

Yep using SAML and that part is working very well.

Automating re-creating the sites with update_config_tool seems to be going well when manually testing.  Need to wrap it inside a PS script then test it as part of push job in Harmony Endpoint today and see where that brings me.

Will share my learnings here if / when I get it going.

[the_rock]

I see what Phoneboy is saying. I recall while ago thats what one of the customers I was helping had to do. Not sure if there is better method these days.

Andy