Technical Tip: Configure FortiAuthenticator SAML with Azure using Microsoft Graph PowerShell

To configure FortiAuthenticator SAML with Microsoft Entra ID, follow these steps:

Step 1: Install the Module with the following command.

Install-Module Microsoft.Graph -Scope CurrentUser

Step 2: Connect to Microsoft Graph.

Connect-MgGraph -Scopes "Domain.ReadWrite.All", "Directory.AccessAsUser.All", "User.Read.All", "Application.ReadWrite.All"

Step 3: Define domain and federation settings.

$domain = "contoso.com"
$PassiveLogOnUri= "https://auth.fortitrustid.forticloud.com/saml-idp/h9p8jetp8eez364e/login/"
$LogOffUri= "https://auth.fortitrustid.forticloud.com/saml-idp/h9p8jetp8eez364e/logout/"
$IssuerUri= "https://auth.fortitrustid.forticloud.com/saml-idp/h9p8jetp8eez364e/metadata/"
$MetadataExchangeUri = "https://auth.fortitrustid.forticloud.com/saml-idp/h9p8jetp8eez364e/metadata/"
$ActiveSignInUri= "https://auth.fortitrustid.forticloud.com/saml-idp/h9p8jetp8eez364e/login/"
$SigningCert= Get-Content "C:\path\auth.fortitrustid.forticloud.cer" -Raw
$DisplayName = "contoso.com"
$FederatedIdpMfaBehavior = "acceptIfMfaDoneByFederatedIdp"

Step 4: Create and verify the domain.

New-MgDomain -Name $domain
Get-MgDomainVerificationDnsRecord -DomainId $domain

Step 5: Configure federation.

New-MgDomainFederationConfiguration -DomainId $domain -PassiveSignInUri $PassiveLogOnUri -SignOutUri $LogOffUri -IssuerUri $IssuerUri -MetadataExchangeUri $MetadataExchangeUri -SigningCertificate $SigningCert -DisplayName $DisplayName -FederatedIdpMfaBehavior $FederatedIdpMfaBehavior -PreferredAuthenticationProtocol "saml" -ActiveSignInUri $ActiveSignInUri

To get the federation configuration output:

Get-MgDomainFederationConfiguration -DomainId "contoso.com" | Format-List

Example output of the Get-MgDomainFederationConfiguration command:

Step 6: Revert to Entra ID as the IDP (if needed).

Update-MgDomain -DomainId $domain -AuthenticationType "Managed"

Step 7: Enable SAML IDP Metadata (/Saml-idp) under the interface service.

Step 8: SAML service provider setting in FortiAuthenticator.