Microsoft MFA support?

[Wessel, Keith]

Hi, all,

I know that the only MFA product that has a plugin supplied by the Shibboleth project is Duo. I'm wondering if anyone has deployed Microsoft MFA on an IdP where the IdP is still doing its own password authentication instead of proxying to EntraID. This has come up on the list a few times, but I haven't seen anything definitive.

There are discussions of some of our campuses possibly moving to Microsoft MFA in the future. One of our campuses still uses Shibboleth without proxying to EntraID and would like to be able to use Microsoft MFA in place of Duo. We've also got the use case of Duo in a non-browser context for ECP authentications using MFA and could ideally use Microsoft MFA in a non-browser context with the IdP, as well.

We could obviously write it ourselves, but I'd like to know if others have already tackled this and can share any wisdom or code.

Thanks,
Keith