Source code may be fragile or unavailable
Vendor apps, older frameworks, and custom portals are often difficult to modify without regression risk.
On-premises MFA
Enable MFA for On-Premises Applications Without Changing Source Code
Datawiza Access Proxy puts modern MFA, SSO, policy, and audit in front of on-premises web applications. Protect legacy portals, internal tools, ERP and CRM systems, OWA, Jira, Confluence, and custom apps without rewriting authentication.
Why it is hard
MFA projects stall when every app needs code work
On-premises applications often need stronger authentication before the app itself is ready for a modernization project.
Modern identity support is uneven
Many on-prem apps were built before SAML, OIDC, WebAuthn, or centralized MFA policies became standard.
Compliance timelines are shorter than rewrite timelines
Security teams may need MFA for cyber insurance, audits, or regulatory requirements before engineering can refactor login.
Each app has a different owner
Datawiza lets teams standardize MFA enforcement at the access layer instead of negotiating a separate integration for every application.
How it works
Add MFA at the gateway layer
Datawiza acts as an MFA proxy in front of the application. It authenticates users, enforces MFA and access policy, then forwards approved traffic to the protected app.
Place Access Proxy in front of the app
Deploy Datawiza Access Proxy as a gateway, reverse proxy, or sidecar pattern depending on the network and application architecture.
Connect your identity and MFA source
Use Microsoft Entra ID, Okta, Duo, Ping, Google Workspace, or Datawiza built-in MFA depending on the rollout path.
Enforce policy before app access
Apply MFA, SSO, headers, group-based access, path-level policy, and audit before requests reach the application.
Roll out app by app
Start with one sensitive application, validate the policy, then expand the same pattern to other on-prem and legacy apps.
MFA methods
Support modern MFA without rebuilding the app
Use the MFA method that fits the workforce, partner population, assurance level, and identity architecture.
Authenticator apps and OTP
Use common authenticator and one-time-passcode flows where they fit the user audience and risk model.
Enterprise identity providers
Integrate with Entra ID, Okta, Duo, Ping, Google Workspace, and other identity providers through standard patterns.
Phishing-resistant MFA
Support higher assurance options such as FIDO2/WebAuthn authenticators and certificate-based authentication.
PIV and smart card programs
Extend MFA to government and regulated environments that rely on PIV smart cards or PKI certificate-based authentication.
Best fit
Where on-premises MFA works best
Datawiza is a strong fit when an on-prem application is important, exposed, audit-sensitive, or hard to modify, and the team needs MFA without waiting for an app rewrite.
For a broader rollout strategy, see no-code MFA and MFA for on-premises applications.
Good candidates include
On-premises employee portals, admin consoles, and internal tools
Customer, partner, vendor, or supplier portals hosted in your environment
ERP and CRM web applications such as JD Edwards, PeopleSoft, Oracle E-Business Suite, Siebel, and Hyperion
Collaboration and business apps such as OWA, Exchange, Jira, and Confluence
Custom Java, .NET, PHP, and legacy web applications that need MFA, SSO, policy, and audit
FAQ
On-Premises MFA Questions
Do we need to modify the application source code?
No. Datawiza enforces MFA in front of the application, so the protected app does not need custom MFA code.
Can this work with our existing identity provider?
Yes. Datawiza can integrate with Microsoft Entra ID, Okta, Duo, Ping, Google Workspace, and other identity providers, or use built-in MFA where that is the right rollout path.
Can Datawiza support phishing-resistant MFA?
Yes. Datawiza can support higher assurance methods such as FIDO2/WebAuthn and certificate-based authentication, depending on the deployment and identity architecture.
Is this only for internal applications?
No. The same access-layer pattern can protect internal tools, customer portals, partner portals, supplier apps, and other on-premises web applications.
Protect one on-prem app first
Bring one application and your preferred identity or MFA source. Datawiza can show where Access Proxy sits and how MFA can be enforced without changing the app.