I have a bunch of machines configured in Azure that use AAD to login. As they currently only require Username and Password I feel that they are at risk. If a user logs in on the web then they are prompted for two factor, but not if they login with the same account to a desktop.
How do I require two factor for RDP/terminal login to any computer joined to my AAD domain?
Just to be clear:
- I have no on-premises Active Directory (and don't want)
- I have no on-premises infrastructure (and don't want)
You can't. Azure Cloud MFA is only available for Office 365, Azure Portal Administration and Cloud Applications.
Available versions of Azure Multi-Factor Authentication
You can, however, install the Azure On-premises MFA Server and use an RD Gateway to accomplish this. RD Gateway is necessary for Windows Server 2012 R2 and later.
Remote Desktop Gateway and Azure Multi-Factor Authentication Server using RADIUS
For Windows Server 2012 and earlier:
Windows Authentication and Azure Multi-Factor Authentication Server