Technical Tip: External Idp Process for SRM

Description

This article describes the key steps SRM teams need to understand in order to support users who are planning to set up an external IdP, as well as how to follow up on the related Sales actions.

  Scope

 External IdP enrollment process and key follow-up actions.

Solution

Overview.

The external IdP enrollment process must be led by the SE (System Engineer) assigned to the User account. 

The SRM (Sales Relationship Manager) is expected to understand the process, ensure that the User receives the appropriate recommendations throughout the setup, and provide the necessary follow-up and coordination with the Sales and Support teams.

This article provides an overview of the enrollment process, key prerequisites, responsibilities, and important considerations when enabling an external Identity Provider (IdP) for a FortiCloud account.

Note: SE contacts, as well as TAM/SRM and advanced support contacts, can be retrieved from the AS_Accounts SharePoint. 

Prerequisites.

Before initiating the external IdP enrollment process, the System Engineer must collect the required information from the user.

The following items are required for the user: 

• To complete the enrollment form: FC-Ext-IdP Enrollment Form.

• To provide the IdP SAML Metadata, the file must be generated and provided by the User based on the IdP configuration. 

Important user considerations.

Before enabling external IdP, ensure that the user understands the impact on existing FortiCloud users.

• Sub-users and IAM users.

Enabling an external IdP on a FortiCloud account will disable sub-users and IAM users, with the exception of the master account, after the IdP transition period. The user must be informed of this behavior before proceeding with the enrollment.

• IAM API users and Partner Access.

Enabling external IdP does not disable IAM API users or Partner roles. Partners having access to the FortiCloud account through a configured Partner role will continue to access the account according to the existing Partner role configuration.

Engage the FortiCloud team.

Once the required User information has been collected, the System Engineer submits the enrollment request to the FortiCloud Team using the internal enrollment alias: forticloud-enroll-extidp@fortinet.com.

Note: This is an internal Fortinet alias. The user must not contact this alias directly for enrollment requests or support.

The SE remains responsible for coordinating the process with the user and ensuring that the appropriate internal teams are engaged.

Approval.

The FortiCloud Team reviews the enrollment request and initiates the required approval process. The enrollment should proceed only after the request has been reviewed and approved by the FortiCloud Team and the feature has been enabled.

External IdP setup and integration.

Once the enrollment request has been approved, the FortiCloud Team provides the information required to complete the External IdP configuration, along with the next steps.

Depending on the configuration, this may include:

• Configuring the appropriate permission profile.

• Setting the appropriate External IdP role.

• Completing the required IdP integration and validation.

The System Engineer should coordinate the remaining setup activities and ensure that the User has the appropriate guidance to complete the integration successfully.

Support and troubleshooting.

The FortiCloud Team is not the first-line support team for users and should not directly interface with the users for standard support or troubleshooting.

For any issues encountered during or after the External IdP setup, Support should coordinate with the System Engineer as appropriate.

The issue should first be investigated using the External IdP troubleshooting documentation: Troubleshooting external IdP.

If additional assistance is required, the Support/Sales team can coordinate with the FortiCloud Team through the internal alias: forticloud-enroll-extidp@fortinet.com 

Additional resources.

For detailed information about External IdP functionality, configuration, and integration, refer to the following FortiCloud documentation: External IdP.

Additional FortiCloud guides and training videos can also be consulted for feature overview, configuration, and integration guidance.