The purpose of this document is to help you use multi-factor authentication to VPN with the Cisco AnyConnect application. Microsoft MFA is replacing the current DUO multi-factor application currently in use at CW. These two applications (MFA and AnyConnect) work together to allow you to connect to the CWF computer network through a Virtual Private Network (VPN) while at home or traveling.
...
MFA is a multi-factor authentication application. It will be used to verify your credentials while you connect to the CWF VPN network. MFA will consist of "something you know" (password) and "something you have" (your phone app). Please refer to How to setup Microsoft MFA for instructions on setting up MFA for the first time.
AnyConnect is the application used to connect to the VPN. It will require MFA before it will connect you. AnyConnect should have been already installed on CWF laptops. Cisco AnyConnect is installed on CWF laptops before they are issued.
...
3. At the next login prompt, you will see a drop-down menu. Select the CWF_VPN (with the underscore) from the drop-down. This will change the way you usually see the VPN login. This is ONLY for those using Microsoft MFA. DUO will still be used the same until it is removed from the network. 
4. The Cisco AnyConnect window below will pop up. If you find you mistakenly chose the wrong VPN Group, you can use the drop down here to change back to using VPN with DUO.
35. This screen will popup asking for your email address. Type in your CWF email here and click Next.
64. The Colonial Williamsburg Federated Sign-On screen will look like this. Ensure your username is correct, type your password and click Sign in.
75. At this time you will need to look at your mobile phone to approve the sign-in. This window will stay on your computer screen until you approve the message on your phone.
NOTE: If you receive a message on your phone that you did not initiate, please hit DENY.
What is on your computer screen: What is on your mobile phone:
86. Once you have approved the phone notification, your computer will open a web browser in order to posture check your system. Click Start.
97. Once the scan is complete you will see the screen change to the below. You are now VPN'd into the CW network.
NOTE: If you do not receive a success message, please take a screen shot and open a Helpdesk ticket. This could be due to a lack of antivirus/anti malware on your computer.
...