---
locale: "en"
updated_at: "2026-11-12T14:38:56.545Z"
canonical: "https://www.isdecisions.com/en/userlock/docs/guides/mfa-implementation/enroll-remote-users"
---

# Enroll remote users in MFA

Where and when users outside your network enroll.

## Where remote users can enroll

Users who work outside the corporate network enroll in MFA through the connection they use. They can only choose among the methods you enable: see [Configure your MFA methods](/userlock/docs/guides/mfa-implementation/configure-your-mfa-methods).

| Connection | Enrollment starts | Methods users can enroll |
| --- | --- | --- |
| Workstation from outside (UserLock Anywhere) | At Windows sign-in | All methods |
| Laptop with an active VPN connection | When the user unlocks the session | All methods |
| UserLock VPN Connect | When the user starts the VPN connection | Push notifications, Authenticator app (TOTP) |
| IIS web application | At first access to the application | Push notifications, Authenticator app (TOTP), FIDO2 security keys |
| RD Gateway | At Remote Desktop session sign-in | Push notifications, Authenticator app (TOTP), FIDO2 security keys |

Authenticator app (TOTP) includes Token2 programmable tokens.

> **Note**
>
> USB keys (HOTP), such as YubiKey and Token2 HOTP keys, can only be enrolled from a session opened directly on the computer. Remote users can enroll them from a workstation outside the network or during a VPN connection, but not through RD Gateway, a web application or UserLock VPN Connect.

## Enroll users who sign in outside the network (UserLock Anywhere)

The Desktop Agent reaches the UserLock server through the UserLock Anywhere public URL. If the user isn’t enrolled yet, the enrollment prompt appears when they sign in to Windows.

**Requirements:**

- The UserLock Desktop Agent installed on the workstation.
- [UserLock Anywhere](/userlock/docs/reference/modules/userlock-anywhere) configured with a public URL. See [Install UserLock Anywhere on IIS](/userlock/docs/guides/installation/install-userlock-anywhere-iis).
- Internet access on the workstation.

**To enroll the user:**

1. Apply an MFA policy to the user. See [Create the MFA access policy](/userlock/docs/reference/access-policies/access-policy-management#creating-an-access-policy).
2. Ask the user to sign in to Windows outside the network and follow the [enrollment guide](/userlock/docs/guides/end-users-mfa-enrollment/) for their method.

## Enroll laptop users connected through a VPN

If a corporate laptop is already outside the network when you enable MFA, the user can enroll during a VPN connection. Enrollment starts when the user unlocks their session.

**Requirements:**

- The UserLock Desktop Agent installed on the laptop.
- A VPN connection to the corporate network.
- A session opened directly on the laptop, not through Remote Desktop.

**To enroll the user:**

1. Apply an MFA policy to the user. See [Create the MFA access policy](/userlock/docs/reference/access-policies/access-policy-management#creating-an-access-policy).
2. Ask the user to connect to the VPN, then lock and unlock their session. The unlock starts enrollment.

## Enroll users through UserLock VPN Connect

When a user connects with UserLock VPN Connect and isn’t enrolled yet, a browser window opens to guide them through enrollment.

**Requirements:**

- [UserLock VPN Connect](/userlock/docs/reference/modules/userlock-vpn-connect) installed and configured. See [Install the UserLock VPN Connect](/userlock/docs/guides/installation/install-userlock-vpn-connect).
- A web browser on the user’s computer.

**To enroll the user:**

1. Apply an MFA policy to the user. See [Create the MFA access policy](/userlock/docs/reference/access-policies/access-policy-management#creating-an-access-policy).
2. Ask the user to start the VPN connection in UserLock VPN Connect and follow the steps in the browser window.

![](https://a.storyblok.com/f/122374/334x367/fbca4ce329/userlock-vpn-connect-mfa-register.png)

## Enroll users from an IIS web application

When a user opens a web application protected with UserLock MFA and isn’t enrolled yet, the enrollment page opens in the browser.

**Requirements:**

- The IIS agent and the UserLock IIS MFA application. See [IIS Applications](/userlock/docs/guides/mfa-implementation/iis-apps).
- For FIDO2 security keys, an IIS MFA public URL within the relying-party ID domain. See [Enable FIDO2 security keys](/userlock/docs/guides/mfa-implementation/configure-your-mfa-methods#enable-fido2-security-keys).

**To enroll the user:**

1. Apply an MFA policy to the user for IIS sessions. See [Create the MFA access policy](/userlock/docs/reference/access-policies/access-policy-management#creating-an-access-policy).
2. Ask the user to open the web application and follow the enrollment steps in the browser.

## Enroll users through RD Gateway

When a user opens a Remote Desktop session through RD Gateway and isn’t enrolled yet, the enrollment prompt appears at session sign-in.

**Requirements:**

- MFA set up for RD Gateway sessions. See [RD Gateway](/userlock/docs/guides/mfa-implementation/remote-desktop-gateway).
- Remote Desktop access through the gateway.
- For FIDO2 security keys, a session host and a Remote Desktop client that support security key redirection. See [FAQ > FIDO2 security keys](/userlock/docs/support/faq/fido2-security-keys).

**To enroll the user:**

1. Apply an MFA policy to the user. See [Create the MFA access policy](/userlock/docs/reference/access-policies/access-policy-management#creating-an-access-policy).
2. Ask the user to connect through RD Gateway and follow the [enrollment guide](/userlock/docs/guides/end-users-mfa-enrollment/) for their method.