How to enroll remote users with MFA
There are several possible ways depending on the situation:
1. UserLock Anywhere
If UserLock Anywhere is activated the desktop agent is able to contact the service through the Internet without the need to connect to a VPN connection.
Follow the steps in the link below to configure UserLock Anywhere: https://www.isdecisions.com/products/userlock/help/use-cases/advanced/userlock-anywhere.htm
2. UserLock IIS MFA*
If MFA for IIS is activated, the user will receive a prompt for MFA enrollment once he/she attempts to connect to their session via a web browser application.
Follow the steps in the link below to configure UserLock IIS MFA: https://www.isdecisions.com/products/userlock/help/use-cases/mfa-for-iis.htm
3. Terminal sessions from outside*
When the user connects to an RDP session via Remote Desktop Gateway this can prompt for MFA enrollment.
Please ensure the following procedure is already in place: https://www.isdecisions.com/products/userlock/help/use-cases/how-to-apply-mfa-to-remote-desktop-gateway-sessions.htm
4. Unlock session to provoke MFA enrollment through VPN
Assuming that the Desktop agent is installed on a work laptop, MFA can be enrolled during a lock/unlock process during a VPN connection:
- User takes work laptop offsite
- VPN connection established to corporate network
- User locks session/Asks UserLock Admin to activate MFA
- User unlocks session which will provoke MFA enrollment
5. UserLock VPN Connect
The user will receive an invitation to enroll in MFA when they attempt to connect to their VPN session via UserLock VPN Connect which will redirect them to a web browser application.
Learn more about UserLock VPN Connect.
NOTE:
* Yubikey and Token2 HOTP not compatible for this method