Can I require a second factor on the VPN?

Yes, with Duo. Tick Enable Duo on the gateway and give it the integration key, secret key and API hostname from a Duo Auth API application. The person gets a push when they connect.

The prompt is sent last, after the certificate, the account and any group rules have already passed. That ordering is deliberate: a push that arrives before those checks would buzz somebody's phone on behalf of a stranger holding a revoked credential. It also means a refusal costs no push at all.

Two behaviours worth knowing before you turn it on. A device certificate is refused on a gateway that requires Duo, because a machine has no phone to prompt and quietly waiving the factor would be worse than saying no. And if Duo cannot be reached you choose what happens — refuse, which is the default and the safer answer, or let people through and record it. That choice is about a Duo outage; it never skips a factor that could have been asked for. Set the gateway's RADIUS timeout to at least 60 seconds, because a push waits for a person to find their phone.

Microsoft Authenticator is not an option, and not for want of trying. Microsoft exposes no supported way to trigger an Authenticator prompt on demand from outside a sign-in — Conditional Access is evaluated during a sign-in the VPN is not performing, and the older interface for it has been retired. The routes that remain need either an on-premise server, which is the thing Passbeam exists to remove, or a browser, which an IKEv2 tunnel does not have. We re-check this; if it changes, it will appear here.