Technical Tip: Configuring SAML SSO login for SSL VPN with Azure AD acting as SAML IdP in FortiManager

1. Enable 'CLI Only Objects' under Policy & Objects -> Object Configurations -> Tools -> Display Options.

2. Configure the SAML user. Ensure that identity provider (IdP)-related entries match the Azure-side configuration.

3. Create a User Group under Policy & Objects -> Object Configurations -> CLI Only Objects:

Notes:

• It is also possible to create a User Group under Policy & Objects -> Object Configurations -> CLI Only Objects.

• 'Config Match' will only appear after creating a User Group.

4. Configure group matching based on Azure Active Directory Group ObjectId.

5. Go to VPN -> SSL VPN Settings. Configure as desired.
6. Go to Policy & Objects. Create a new SSL VPN firewall policy or modify an existing one to apply to the group that contains the SAML user configured in step 3.