The recurrent issue is saying "mfa" and "active directory" together. There is no ad support (unless you consider the virtually unused smartcards) for mfa buit i

The recurrent issue is saying "mfa" and "active directory" together. There is no ad support (unless you consider the virtually unused smartcards) for mfa buit in, and the long running "just use duo on the rdp service" argument someone always makes misses the mark as rdp isn't the only protocol useful to an attacker. Microsoft has for a while claimed to have an answer, in the form of the "if everything is in azure you don't need AD" non answer.