---
locale: "en"
updated_at: "2025-10-27T13:36:17.053Z"
canonical: "https://www.isdecisions.com/en/userlock/docs/guides/end-users-mfa-enrollment/enroll-remote-users"
---

# Enroll Remote Users in MFA

Via VPN, IIS web apps, RD Gateway, or UserLock Anywhere.

## Overview

Remote users can enroll in MFA through different UserLock components. The appropriate method depends on how users connect to your environment (via VPN, IIS web apps, Remote Desktop Gateway, or UserLock Anywhere).

| Session type | Enrollment trigger |
| --- | --- |
| Workstation from outside (UserLock Anywhere) | At Windows logon outside the corporate network |
| IIS | When accessing an IIS web app for the first time |
| Terminal from outside (RD Gateway) | When starting an RDP session through RD Gateway |
| Workstation with VPN connection | When unlocking the session during an active VPN connection |
| UserLock VPN Connect | When opening a VPN session via the UserLock VPN Connect |

## 1. Workstation session from outside

#### Trigger

When the user logs on to Windows outside the corporate network, the Desktop agent can reach the UserLock service directly via the public Anywhere URL.
The MFA enrollment dialog appears if the account is not yet enrolled.

#### Typical workflow

1. Administrator enables MFA for the account.
2. User signs in to Windows from outside the network.
3. The MFA enrollment dialog appears and completes automatically.

#### Requirements

- Desktop Agent installed on the workstation.
- **UserLock Anywhere** configured with a public URL.
- Internet connection available.

#### Configuration

- [Configure UserLock Anywhere](/userlock/docs/guides/installation/install-userlock-anywhere-iis)
- [Apply MFA](/userlock/docs/guides/mfa-implementation/how-to-implement-mfa)

#### Available enrollment methods

- [UserLock Push application](/userlock/docs/guides/end-users-mfa-enrollment/userlock-push-app)
- [Authenticator application](/userlock/docs/guides/end-users-mfa-enrollment/authenticator-application)
- [Yubikey](/userlock/docs/guides/end-users-mfa-enrollment/yubikey-hotp-programmable-token)
- [Token2 programmable token](/userlock/docs/guides/end-users-mfa-enrollment/token2-programmable-token)
- [Token2 HOTP](/userlock/docs/guides/end-users-mfa-enrollment/token2-HOTP)

## 2. IIS session

#### Trigger

When the user accesses a web application protected by IIS MFA, the enrollment prompt appears during the first connection if the account is not yet enrolled.

#### Typical workflow

1. Administrator enables MFA for the account
2. User opens the web application
3. MFA enrollment is displayed and completed in the browser

#### Requirements

- IIS integration with UserLock
- Browser access to the web application

#### Configuration

- [Configure MFA for IIS applications](/userlock/docs/guides/mfa-implementation/mfa-iis-apps)

#### Available enrollment methods

- [UserLock Push application](/userlock/docs/guides/end-users-mfa-enrollment/userlock-push-app)
- [Authenticator application](/userlock/docs/guides/end-users-mfa-enrollment/authenticator-application)
- [Token2 programmable token](/userlock/docs/guides/end-users-mfa-enrollment/token2-programmable-token)
- ~~Yubikey~~
- ~~Token2 HOTP~~

## 3. Terminal session from outside

#### Trigger

When the user connects to a Remote Desktop session through RD Gateway, the enrollment prompt appears if MFA enrollment is pending.

#### Typical workflow

1. Administrator enables MFA for the account
2. User connects via RD Gateway
3. MFA enrollment is displayed during session logon

#### Requirements

- UserLock integration with RD Gateway
- RDP access through the gateway

#### Configuration

- [Apply MFA to Remote Desktop Gateway sessions](/userlock/docs/guides/mfa-implementation/mfa-remote-desktop-gateway-sessions)

#### Available enrollment methods

- [UserLock Push application](/userlock/docs/guides/end-users-mfa-enrollment/userlock-push-app)
- [Authenticator application](/userlock/docs/guides/end-users-mfa-enrollment/authenticator-application)
- [Token2 programmable token](/userlock/docs/guides/end-users-mfa-enrollment/token2-programmable-token)
- ~~Yubikey~~
- ~~Token2 HOTP~~

## 4. VPN Session (Lock/Unlock method)

#### Trigger

On a corporate laptop with the Desktop Agent installed, if MFA is not yet enrolled, the prompt appears when the user unlocks the workstation during an active VPN connection.

#### Typical workflow

1. The user takes the work laptop offsite.
2. User connects the VPN.
3. Administrator enables MFA for the account.
4. The user locks and unlocks the session, the unlock triggers MFA enrollment.

#### Requirements

- Desktop Agent installed
- VPN tunnel connected to the corporate network
- Local desktop session (not RDP)

#### Configuration

- [Apply MFA](/userlock/docs/guides/mfa-implementation/how-to-implement-mfa)

#### Available enrollment methods

- [UserLock Push application](/userlock/docs/guides/end-users-mfa-enrollment/userlock-push-app)
- [Authenticator application](/userlock/docs/guides/end-users-mfa-enrollment/authenticator-application)
- [Yubikey](/userlock/docs/guides/end-users-mfa-enrollment/yubikey-hotp-programmable-token)
- [Token2 programmable token](/userlock/docs/guides/end-users-mfa-enrollment/token2-programmable-token)
- [Token2 HOTP](/userlock/docs/guides/end-users-mfa-enrollment/token2-HOTP)

## 5. UserLock VPN Connect

#### Trigger

When users connect via UserLock VPN Connect, the system redirects them to a browser window to complete MFA enrollment if required.

#### Typical workflow

1. Administrator enables MFA for the account.
2. User initiates the VPN connection via the UserLock VPN Connect.
3. A browser window opens and guides MFA enrollment.

![](https://a.storyblok.com/f/122374/334x367/fbca4ce329/userlock-vpn-connect-mfa-register.png)

#### Requirements

- UserLock VPN Connect properly configured.
- Browser available during VPN connection setup.

#### Configuration

- [Configure UserLock VPN Connect](/userlock/docs/guides/installation/userlock-vpn-connect)

#### Available enrollment methods

- [UserLock Push application](/userlock/docs/guides/end-users-mfa-enrollment/userlock-push-app)
- [Authenticator application](/userlock/docs/guides/end-users-mfa-enrollment/authenticator-application)
- [Token2 programmable token](/userlock/docs/guides/end-users-mfa-enrollment/token2-programmable-token)
- ~~Yubikey~~
- ~~Token2 HOTP~~