{"id":1327,"date":"2026-01-24T14:32:36","date_gmt":"2026-01-24T12:32:36","guid":{"rendered":"https:\/\/dety.net.ua\/?p=1327"},"modified":"2026-01-24T14:33:31","modified_gmt":"2026-01-24T12:33:31","slug":"nps-extension-for-azure-mfa-renew-a-certificate-alternative-way","status":"publish","type":"post","link":"https:\/\/dety.net.ua\/?p=1327","title":{"rendered":"NPS extension for Azure MFA + Renew a certificate + Alternative way"},"content":{"rendered":"\n

My certificate for NPS Azure MFA was expired but I couldn’t renew it with the integrated script because there was a problem with a connection to Azure from a command line. Connect-MSonline and Connect-MgGraph were interrupted with an error: Something went wrong. I have another server and it works on it. I’ve decided to generate a new certificate from this server.<\/p>\n\n\n\n

    \n
  1. Delete all the old certificates for NPS Azure MFA.<\/li>\n\n\n\n
  2. Install the latest NPS extension.<\/li>\n\n\n\n
  3. Export the registry part from a NPS server: Computer\\HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\AzureMfa<\/strong><\/li>\n\n\n\n
  4. Import the registry to the working server.<\/li>\n\n\n\n
  5. Copy the script from “C:\\Program Files\\Microsoft\\AzureMfa\\Config\\AzureMfaNpsExtnConfigSetup.ps1<\/strong>” somewhere to the working server.<\/li>\n\n\n\n
  6. Copy C:\\Program Files\\WindowsPowerShell\\Modules\\AzureMfaClientCertProvider<\/strong> from the NPS to the same place on the working server.<\/li>\n\n\n\n
  7. Run AzureMfaNpsExtnConfigSetup.ps1<\/strong> on the working server. It will generate a new self-signed certificate and upload it to Azure.<\/li>\n\n\n\n
  8. Run certlm.msc<\/strong> and export the certificate with the key.<\/li>\n\n\n\n
  9. Import the certificate to NPS server.<\/li>\n\n\n\n
  10. Get the thumbprint for this certificate: Get-ChildItem Cert:\\LocalMachine\\My<\/strong><\/li>\n\n\n\n
  11. Get the key container for the certificate: certutil -v -store My <your thumbprint><\/strong><\/li>\n\n\n\n
  12. Go to: C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys<\/strong> and find the container.<\/li>\n\n\n\n
  13. Open Properties and on the Security tab grant READ access for NETWORK SERVICE<\/strong>.<\/li>\n\n\n\n
  14. Open registry Computer\\HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\AzureMfa<\/strong> and create a string parameter: OVERRIDE_NUMBER_MATCHING_WITH_OTP<\/strong> with the value FALSE<\/strong> <\/li>\n\n\n\n
  15. Restart NPS service or even the server.<\/li>\n<\/ol>\n\n\n\n

    Some useful links:<\/p>\n\n\n\n

    https:\/\/github.com\/unscrpt\/azuremfanps<\/a><\/p>\n\n\n\n

    https:\/\/learn.microsoft.com\/en-us\/entra\/identity\/authentication\/howto-mfa-nps-extension<\/a><\/p>\n\n\n\n

    https:\/\/www.microsoft.com\/en-us\/download\/details.aspx?id=54688<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

    My certificate for NPS Azure MFA was expired but I couldn’t renew it with the integrated script because there was a problem with a connection to Azure from a command line. Connect-MSonline and Connect-MgGraph were interrupted with an error: Something went wrong. I have another server and it works on it. I’ve decided to generate […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,12],"tags":[],"class_list":["post-1327","post","type-post","status-publish","format-standard","hentry","category-novosti","category-windows"],"_links":{"self":[{"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/posts\/1327","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dety.net.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1327"}],"version-history":[{"count":2,"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/posts\/1327\/revisions"}],"predecessor-version":[{"id":1329,"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/posts\/1327\/revisions\/1329"}],"wp:attachment":[{"href":"https:\/\/dety.net.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1327"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dety.net.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1327"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dety.net.ua\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1327"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}