According to the Microsoft Identity and Access Administrator (SC-300) Exam Study Guide and Microsoft Learn module "Implement and manage hybrid identity with Azure AD Connect", when a VPN solution authenticates users through an on-premises Active Directory and does not natively support Azure MFA, the correct method is to integrate Azure MFA using the Network Policy Server (NPS) extension for Azure MFA.
The NPS extension acts as an intermediary between the VPN server and Azure AD. The VPN server sends authentication requests to the NPS server. The NPS server validates the credentials against the on-premises Active Directory, and then the NPS extension triggers the Azure MFA challenge for secondary authentication.
Microsoft documentation states:
"To enable Azure Multi-Factor Authentication for on-premises resources such as VPNs, RD Gateway, and other services using RADIUS authentication, you must install the Azure MFA extension for the Network Policy Server (NPS)." Therefore, the correct recommendation is to deploy and configure NPS on-premises, install the Azure MFA NPS Extension, and configure the VPN server to forward RADIUS requests to NPS.