Ability To Force MFA to connect to Vault Gateway

[mknoblauch8QMHB]

Right now it is up to the individual users or the admin of their license server to enforce multi-factor authentication on AutoDesk IDs. The security requirements at my company call for us to enforce multi-factor authentication to be able to use the Vault Gateway to allow external access to our Vault Server. Since we are not in control of the license servers of the external companies we work with we are not able to enforce MFA for users connecting to the Vault Gateway that do not work at our company.  

[ihayesjr]

@mknoblauch8QMHB 

Thank you for posting the idea. However, Vault Gateway doesn't perform any authentications nor integrates with authentication software. This would not be possible to implement.

[mknoblauch8QMHB]

Okay is there a way that MFA could be forced at the Vault Server level then? 

[ihayesjr]

No, because Vault Server would need access to everyone's authentication software accounts and see if they have turned it out. This is impossible.

[mknoblauch8QMHB]

It looks like Azure does store information on whether the login was MFA or not:

Sign-in event details for Azure AD Multi-Factor Authentication - Microsoft Entra | Microsoft Learn

Would it be possible to setup something like this:

Mandating multifactor authentication (MFA) for your partner tenant - Partner Center | Microsoft Lear...

[ihayesjr]

Sorry, but Vault does not integrate with Azure for authentication and still wouldn't be able to perform this request.

[mknoblauch8QMHB]

The license manager does integrate with Azure though. Is it possible to enhance the information that is stored in the Vault Professional client when it gets a license from the license manager so that Vault Professional is aware if MFA was used when the user authenticated to retrieve the license. And if you can do this could you then pass this information on to the Vault Gateway or to Vault Server so that it could prevent users that did not authenticate using MFA from accessing the Vault? 

[mknoblauch8QMHB]

I don't believe Vault would necessarily need direct access to users' Microsoft Entra ID accounts or MFA enrollment details to support this use case.

In a federated authentication model, an application does not typically verify MFA itself. Instead, it trusts the Identity Provider (IdP), such as Microsoft Entra ID, to perform authentication and enforce MFA requirements.

A common flow looks something like:

1. User attempts to access the application.
2. The application redirects authentication to Entra ID.
3. Entra ID enforces Conditional Access policies and MFA requirements.
4. Entra ID returns a signed SAML assertion or OpenID Connect (OIDC) token.
5. The application validates the token and can inspect standard authentication claims.

Microsoft Entra ID supports both SAML and OIDC and can provide authentication-related claims such as authentication method references (amr), authentication context (acrs), and authentication time (auth_time). These allow an application to make trust decisions based on the authentication performed by the identity provider, without needing visibility into a user's MFA settings or authenticator application.

Because of that, the request is really less about Vault implementing MFA directly and more about support for standards-based federation with external identity providers.

If Vault Gateway could consume and validate SAML assertions or OIDC tokens from providers such as Microsoft Entra ID, organizations could potentially leverage their existing MFA and Conditional Access policies rather than requiring Vault to manage MFA itself.

I'm curious whether there are technical limitations within Vault Gateway that would prevent this approach?

• Optional claims reference - Microsoft identity platform | Microsoft Learn

• AMR values for Microsoft Entra authentication methods

• SAML 2.0 token claims reference - Microsoft identity platform | Microsoft Learn