What’s the most affordable way to add MFA to Meraki IKEv2 VPN?

Since you’re already heavily invested in Microsoft, check whether your existing Entra setup can provide the MFA path for the VPN authentication. The exact method depends on the Meraki and RADIUS integration, so verify that the chosen flow supports the IKEv2 client rather than only AnyConnect. You may be able to keep the current NPS design while adding Microsoft’s MFA component instead of replacing everything.

If you have the appropriate Microsoft licensing, an alternative is to use Intune’s Cloud PKI to issue client certificates and pair it with a hosted RADIUS provider. That gives you certificate-based device authentication rather than relying only on a shared username-and-password flow. For a very tight budget, you could also run FreeRADIUS on a small cloud instance, although you would then be responsible for securing, updating, and operating it.

Cloudflare’s Zero Trust service can be free for organizations with fewer than 50 users and may provide a different way to control access to internal resources. It isn’t a direct MFA plug-in for Meraki’s IKEv2 RADIUS authentication, and it may not preserve the same full-tunnel file-transfer behavior, but it could be worth considering if the main goal is secure access rather than keeping the existing VPN architecture.

Duo is worth investigating. It can sit in front of RADIUS and add MFA without requiring you to build and maintain another full directory environment. Cisco owns Duo now, but it’s generally available directly, and for a small number of users the pricing may be reasonable.