FortiClient EMS Cloud SAML Registration 403 Error - app_not_configured_for_user

We’re trying to use this authentication method for firewall rule authentication but get the same thing, despite all parameters being correct. Did you find a solution?

Hello SKIBBIDI and cjackson_ncl,

I found those answers, can you tell us if it helped, please?

Possible Cause

Based on the provided context, Google Workspace SAML with EMS requires the EMS Service Provider settings to be configured correctly, especially:

• SP Address must be a publicly accessible FQDN for EMS
• In the Google custom SAML application:
  • ACS URL (Google) must match SP ACS (login) URL (EMS)
  • Asset ID (Google) must match SP Entity ID (EMS)

The context also states:

• After creating the custom SAML application, it is necessary to allow users who use custom applications
• Application rights can be narrowed down using groups

What to check

Since you already verified user access is ON for all users, and ACS URL / Entity ID match, the remaining items from the context to validate are:

• Confirm the EMS SP Address is a publicly accessible FQDN

  • If EMS Cloud SAML is using an address that is not publicly reachable or not the correct public FQDN, authentication may fail

• Recheck the exact values copied from EMS

  • SP ACS (login) URL
  • SP Entity ID
  • Make sure they were copied exactly into Google Workspace with no mismatch

• Verify the custom SAML application is actually assigned for the affected user

  • The context specifically notes that after app creation, users must be allowed to use custom applications
  • If rights are restricted by groups, confirm the user is in the correct group

Important detail

The error string app_not_configured_for_user strongly suggests a Google Workspace application access/assignment issue, not necessarily a FortiGate HA issue. From the context, the most relevant Google-side requirement is: Users must be allowed to use the custom SAML application.

FortiGate relevance

From the provided context, there is no indication that the FortiGate 90G HA pair affects EMS Cloud SAML registration in this workflow. The issue appears centered on:

• EMS SAML Service Provider configuration
• Google Workspace custom SAML application configuration
• User access to the custom application

Suggested next validation order

1. Confirm EMS SP Address is a public FQDN
2. Re-copy SP ACS URL and SP Entity ID from EMS into Google
3. Confirm the user is explicitly allowed to use the custom SAML app
4. If using group-based access, verify group membership

Conclusion

Most likely area to fix

Based on the available context, the most likely fix is to verify Google Workspace user entitlement to the custom SAML app and confirm the EMS SP Address is a publicly accessible FQDN. The 403 - app_not_configured_for_user message aligns most closely with the Google app access requirement noted in the configuration guidance.