MFA VPN screen does not appear on Logon screen

[MarcuzShinz]

Dear Guy!

Currently, we are facing an issue with remote access VPN connectivity on Check Point, specifically:

1. We are deploying Check Point VPN with MFA via Azure. When we log in to Windows and initiate the VPN connection, an MFA popup appears for authentication, and the connection is successfully established.

2. The issue we are encountering is that when we attempt to connect to the VPN from the Windows logon screen, the MFA popup does not appear, causing the VPN connection to fail.

=> Is there a way to configure the system to display the MFA popup outside the Windows logon screen?

[PhoneBoy]

The ability to prompt for VPN connection before Windows login is a feature we call SDL (Secure Domain Logon).
Because there is no user at the Windows login screen and a browser is needed to perform the authentication, the browser runs with the only permissions it has: SYSTEM.
That's potentially dangerous and thus why we do not support SDL with SAML authentication.

Having said that, we've come up with a different authentication flow for this use case that is more secure.
Specifically, instead of authenticating on the local browser, a QR code is displayed which you can use to complete the authentication flow from a different device.
However, it is currently only available as a customer release tied to a specific version/JHF level and VPN client release.
Contact your local Check Point office for additional information.