The app cannot move yet
Residency, compliance, architecture, or operational constraints may keep the application on premises.
MFA for on-prem apps
Add MFA to On-Premises Applications Without Changing Code
Deploy Datawiza Access Proxy close to your on-premises application and enforce MFA before users reach the app. Keep the app where it runs today while modernizing access with Datawiza MFA or your existing identity provider.
Why on-prem MFA is hard
On-premises apps often predate modern identity controls
Login code is risky to modify
Older frameworks, vendor packages, and fragile session behavior make authentication changes slow.
Network paths are already complex
On-prem apps may sit behind VPN, ZTNA, load balancers, gateways, or internal DNS.
Security teams still need MFA
High-value on-prem apps need stronger authentication even when app modernization is not ready.
How it works
Deploy an access layer in front of the on-prem app
Run Datawiza near the app
Deploy Datawiza in your data center, VPC, private cloud, or hosted model depending on the network path.
Route traffic through the proxy
Use an existing gateway, load balancer, internal DNS, or reverse proxy pattern to put Datawiza in the request path.
Turn on MFA
Use Datawiza MFA for speed or integrate with your IdP for centralized workforce policy.
Keep the app unchanged
Forward approved traffic to the application while Datawiza handles MFA and access decisions before the app.
Best fit
Where on-prem MFA fits best
This approach is strongest when the application should stay on premises but still needs modern authentication controls.
For a Microsoft-specific pattern, see Azure MFA for on-premises applications.
Good candidates include
Internal legacy web apps used by employees and contractors
On-prem customer, partner, supplier, or vendor portals
Apps behind F5, Nginx, Azure App Gateway, AWS ALB, VPN, or ZTNA
Applications that need MFA but cannot be moved to the cloud yet
Hybrid environments using Entra ID, Okta, OIDC/SAML, or Datawiza MFA
Deployment options
Keep the app local while modernizing access
Data center deployment
Run Datawiza close to applications that remain in your own network.
Private VPC deployment
Protect private apps in hybrid or staged cloud migration architectures.
Existing gateway integration
Fit Datawiza into the load balancer or gateway path already serving the app.
App-by-app rollout
Start with one on-prem app, validate access and logs, then expand.
FAQ
MFA for on-premises applications FAQ
Can we keep the application on premises?
Yes. Datawiza can run in front of on-premises applications while the app and data remain in your environment.
Do we need to change application code?
No. Datawiza enforces MFA at the access layer before traffic reaches the application.
Can we use our existing IdP?
Yes. Datawiza can integrate with OIDC/SAML identity providers, or teams can use Datawiza MFA where that is the faster path.
Is this only for internal apps?
No. The same pattern can protect internal apps and on-prem customer, partner, supplier, or vendor portals.
Add MFA to one on-prem app first
Datawiza can review the app, gateway, and routing path and show how MFA fits in front of it without changing source code.