vpn two-factor prompt never appears at login

TL;DR

When the VPN accepts the password but the two-factor prompt never appears, the breakdown is between the VPN server and the MFA provider: RADIUS challenge handling, push delivery, or the client swallowing the prompt. Trace the RADIUS exchange and test the MFA path directly.

The query

vpn two-factor prompt never appears at login

Use this when

• VPN login hangs after the password with no MFA prompt
• push approvals work for other apps but not VPN
• migrated MFA provider and VPN prompts stopped

Not for

• password rejected (fix credentials first)
• MFA prompt appears but approvals fail
• VPN client not launching at all

Steps

1. Check the VPN server logs for the RADIUS exchange to see whether a challenge was sent. Expected output: you see whether the server issued the challenge
2. Test the MFA path directly, such as triggering a push from the MFA admin console. Expected output: push delivery confirmed working or broken
3. Verify the RADIUS shared secret matches on both the VPN server and the MFA server. Expected output: secrets match
4. Check the VPN client version handles RADIUS challenges; some older clients swallow the prompt. Expected output: client version supports the challenge flow
5. Confirm the user's MFA enrollment is active and the right device is targeted. Expected output: enrollment healthy
6. Retry the VPN login and watch both the server log and the user's device. Expected output: the prompt appears and the login completes

Provenance

Resolved from the public thread: https://vectle.com/posts/pstMwVv8rQTNYlBjesNs19dw