Entra ID or ADFS two-factor authentication support for VMware Live Site Recovery.

Products

• VMware Site Recovery Manager 8.x
• VMware vCenter Server
• VMware Live Recovery

Issue/Introduction

• The SRM UI displays 'Invalid Credentials' when an AD account uses ADFS two-factor authentication (like Entra ID) using an AD account.
• Clicking 'Open Site Recovery' in vCenter 8.0U3g redirects to a local login prompt rather than passing through Entra ID tokens.
• SRM does not support two-factor authentication in ADFS, but it works with [e-mail].
• When the vCenter username and password are entered to log into vSphere Client, the user is redirected to a custom authentication page where a passcode is entered, or it sends a push to a mobile device to complete the login. This works fine for vCenter logins but when fails for Site Recovery UI.
• This only happens with AD accounts, but it works fine with vSphere.local accounts (as these are not redirected for the additional security check).
• When Site Recovery UI is accessed via the plugin in vCenter, SRM UI does not accept auto login of domain accounts when ADFS/Azure AD is configured. However, manual login works with the same account. The issue is not seen when AD over LDAP/s is configured.
• VLSR does not authenticate users configured with MFA but it works with users without MFA.

Environment

• vCenter 7.x
• vCenter 8.x
• vCenter 9.x
• VMware Site Recovery Manager 8.x
• VMware Site Recovery Manager 9.x
• VMware Live Recovery

 

Cause

Site recovery UI does not support ADFS/Azure AD (like Entra ID) for non-VMC environments.

 

Resolution

This is working as designed. Currently, SRM does not support ADFS/Azure two-factor authentication or configuring SRM with external OAuth2/Identity Providers (IDPs).

Additional Information

NOTE: Azure Multi-Factor Authentication (MFA) is a security feature that adds an extra layer of protection to your Azure account by requiring more than one verification method for sign-in. It helps prevent unauthorized access, even if your password is compromised. MFA is a core component of a strong identity and access management (IAM) policy.

This feature is being considered to be implemented on a future VLSR release.