Which Captive Portal mode must be configured to support MFA authentication?

NTLM is an authentication protocol primarily used for Windows network authentication and does not inherently support or enable MFA for Captive Portal in the way a redirect page does.

Redirect mode in Captive Portal explicitly redirects unauthenticated users' web browser traffic to a configurable authentication portal, allowing for integration with external authentication services that support MFA challenges before granting network access.

Single Sign-On (SSO) is an authentication method, but it's a feature that would be *used* with Captive Portal, not a Captive Portal *mode* itself for MFA enablement.

Transparent mode for Captive Portal intercepts traffic without explicit redirection, which typically prevents the necessary user interaction and external page redirection required for MFA.