Entraid SSO on demand captive portal.

I can't find the right configuration.

I can successfully authenticate users using Entra ID and firewall policies.

However, what I want to achieve is to have a rule that allows traffic for unauthenticated users and several rules for authenticated groups (Entra ID).

I don’t see the option for a captive portal that allows on-demand SSO authentication.

It’s possible that I’m thinking this wrong since we migrated from Sophos XG, where you could log in to its captive portal and authenticate with Entra ID SSO.

Any help will be appreciated