Azure MFA NPS Extension Configuration Failure Due to Microsoft Graph PowerShell Module Conflicts

Introduction

When configuring the Azure MFA NPS Extension using the official script (AzureMfaNpsExtnConfigSetup.ps1), administrators may encounter a failure during the update of the Azure Active Directory service principal. The script attempts to push certificate data using the Microsoft Graph PowerShell SDK, and the process fails with the following error:

Update-MgServicePrincipal : Cannot convert the literal '<cert_blob>' to the expected type 'Edm.Binary'.
Status: 400 (BadRequest)

This issue typically occurs due to multiple versions or conflicting installations of the Microsoft Graph PowerShell modules, which can lead to serialization or data formatting errors during API operations.

This KB provides a tested remediation process by removing all existing Graph modules and reinstalling the required components cleanly.

Instructions

✅ Step 1 – Manually Uninstall All Microsoft.Graph Modules

Open PowerShell as Administrator and run the following script to uninstall all installed versions of any Microsoft.Graph modules:

$Modules = Get-Module Microsoft.Graph* -ListAvailable | Where {$_.Name -ne "Microsoft.Graph.Authentication"} | Select-Object Name -Unique
Foreach ($Module in $Modules)
{
    $ModuleName = $Module.Name
    $Versions = Get-Module $ModuleName -ListAvailable
    Foreach ($Version in $Versions)
    {
        $ModuleVersion = $Version.Version
        Write-Host "Uninstall-Module $ModuleName $ModuleVersion"
        Uninstall-Module $ModuleName -RequiredVersion $ModuleVersion
    }
}

# Uninstall Microsoft.Graph.Authentication
$ModuleName = "Microsoft.Graph.Authentication"
$Versions = Get-Module $ModuleName -ListAvailable
Foreach ($Version in $Versions)
{
    $ModuleVersion = $Version.Version
    Write-Host "Uninstall-Module $ModuleName $ModuleVersion"
    Uninstall-Module $ModuleName -RequiredVersion $ModuleVersion
}

After the script completes, manually rerun it until this command returns no results:

Get-InstalledModule | Where-Object { $_.Name -like "Microsoft.Graph*" }

📝 Note: Some modules may be reloaded or may not uninstall cleanly on the first attempt, especially if there are versioning or dependency overlaps. Repeating the uninstall step ensures a clean removal.

✅ Step 2 – Install Required Microsoft Graph Modules

Once all previous versions are removed, install only the latest required modules:

Install-Module Microsoft.Graph

✅ Step 3 – Rerun the Configuration Script

With a clean module set installed, rerun the configuration script:

C:\Program Files\Microsoft\AzureMfa\Config\AzureMfaNpsExtnConfigSetup.ps1

The script should now complete successfully, allowing Azure MFA to integrate with the NPS service and Remote Desktop Gateway.

Additional Notes

This issue has been independently reported in the sysadmin community and is reproducible in environments where Microsoft Graph modules are upgraded over time without cleanup.

No interference was found from Microsoft Defender in typical environments, though exclusions may still be useful in some configurations.

Quick guide Azure point to site VPN certificates generation and installation

The first step is to run the below code and make your new certificates

connect-azaccount

$cert = New-SelfSignedCertificate -Type Custom -KeySpec Signature -Subject "CN=P2SRoot2022" -KeyExportPolicy Exportable -HashAlgorithm sha256 -KeyLength 2048 -CertStoreLocation "Cert:\CurrentUser\My" -KeyUsageProperty Sign -KeyUsage CertSign

New-SelfSignedCertificate -Type Custom -DnsName P2SChildCert -KeySpec Signature -Subject "CN=P2SChild2022" -KeyExportPolicy Exportable -HashAlgorithm sha256 -KeyLength 2048 -CertStoreLocation "Cert:\CurrentUser\My" -Signer $cert -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.2")

Once this is done, you need to export the root as a .cer without the private key and then the child as a pfx with the private key and a password.

You then need to add the cer root in to Azure P2S config by opening the .cer file and selecting and copying all the text between the following

---------BEGINE CERTIFICATE---------

---------END CERTIFICATE--------------

and paste the text in to the Azure portal, then import the child in to the client system in the following location

Current User\Personal\Certificates

This should be it, but sometimes it does not work,  if you get error 798 in the client; download the vpn set up from the Azure portal and install over the top of its self.  this should correct that error.

Generate and export certificates for P2S: PowerShell - Azure VPN Gateway | Microsoft Learn

Install a Point-to-Site client certificate - Azure VPN Gateway | Microsoft Learn

Get Azure AD Users SID's

Powershell

On a computer run the following within PowerShell ISE

Import-Module -Name AzureAD
Connect-AzureAD

function Convert-ObjectIdToSid
{
    param([String] $ObjectId)
     $d=[UInt32[]]::new(4);[Buffer]::BlockCopy([Guid]::Parse($ObjectId).ToByteArray(),0,$d,0,16);"S-1-12-1-$d".Replace(' ','-')
}

Then

Get-AzureADUser | ForEach { [pscustomobject] @{ Name= $_.DisplayName; Sid=Convert-ObjectIdToSid($_.ObjectId)}}

You can do a search within the Get-AzureADUser by using the -SearchString "<USERNAME>"

As the user logged in to a device

Open CMD and type

whoami /user

M365 and Azure on-prem AD Sync Tool force a Delta update

1. Run PowerShell Elevated
2. Run the following "Import-Module –Name "C:\Program Files\Microsoft Azure AD Sync\Bin\ADSync" -Verbose"
3. Run "Start-ADSyncSyncCycle -PolicyType Delta"

This has to be done on the server that has the AD sync tool installed on.