Configure Fortigate SSL VPN to use Azure AD as SAML IDP (MFA / Conditional Access)

Welcome to this tutorial video on Using Azure AD and SAML to authenticate Foritgate SSL VPN Users.

Traditionally to authenticate VPN users you would use LDAP or Radius. Radius was required if you needed to provided different levels of access to different groups of users. And would be handled by having the Radius server return a Vendor-specific attribute that matched the name of a group defined on the Fortigate.

But what if you want to authenticate agains Azure AD, and make use of Multi-factor Authentication. This video will allow you to provide Role based access to users with full access to Azure AD MFA as well as Conditional Access policies.

There are other solutions that make use of radius, and an add-on for Network Policy Server, but these solutions have limitation regarding authentication methods and returning vendor specific attributes for role based access.

I am using FortiOS 7.0 on my lab appliance and a newly created trial Microsoft 365 tennant. However documentation states that this should work with all versions of FortiOS 6.2 and Higher.

Fortinet Docs:

**Note: It seems the Documentation from Fortinet has been taken down Please find this link to an alternate PDF copy of the doc (See pg 140):

Microsoft Docs:

No group info in SAML response:

[joshpark]

I've been pouring over the config documents from both Azure and Fortigate side for about a week preparing to get it done this week. Always helpful to see someone actually do it though and I'm really happy you left the troubleshooting in there. Invaluable! Liked and subscribed sir, thank you!

[denmanfite]

Great video. Really enjoyed how you showed the whole process including the small issues you ran into.

[thom]

Thank you Dan! I was able to setup the same within 1.5 hours thanks to your vid.
If anyone cares: If using FIDO2 key (passwordless), you have to select the option in the Forticlient VPN profile to authenticate using the browser.

[jaspreetmangat]

One of the best fortigate SSL VPN integration with azure AD using SAML tutorial

[CrvTEC]

Great, Thank you! This works out perfectly!! Multiple groups with different access and I was also able to configure access to go over a S2S VPN as well.

[JamesNationMusic]

Dude thank you! One thing to note, is that you dont need the quotes anymore on 7.2.8 firmware.

[_retrogamer]

absolute genius. straight forward and easy to follow

[attiland]

Best content in the subject for months in the subject I have come across. Thank you

[stevencamacho]

Top notch demonstration. I'll be implementing this soon and this video is a great resource to have.

[michaelramirez]

Thank you for creating this content Dan. Great video and instructions. It was incredibly helpful.

[AmitKhandelwal]

Thanks a ton for the great Video. Each and every step in detail.

[sacoderch]

Great Video! I am using in version 6.2.9 too

[WReaume]

Great vid. My free Azure account would not allow me to add groups to the FortigateSSL enterprise app thingy in Azure, only users. But, you could kick it a bit on the login and could evenutally get to the SSL portal. Thanks for the useful video and info. Make more vids!

[peterliu]

great video. really informative .well organized and detailed. thanks for sharing. would like to see more upload from you.

[raulkamal]

Excellent video. Thanks for all your help!

[markb]

Thanks for taking the time providing this great guide

[amiryousry]

I would like to thank you for this amazing video. Really helpful

[eduarmoran]

Excellent video Dan! thank you so much

[billbaltas]

Thanks for posting this. This really helped me.

[asherxtn]

Thanks, great video.

I was stuck when I forgot to add the new group to my existing policy, then I found your video at 29:06 strange that it wouldn't even let you sign in without a policy.