FortiGate SAML Authentication Not Redirecting When Accessing Microsoft Services
We are configuring SAML authentication on our FortiGate firewall to authenticate users before applying internet access policies.
Our requirement is:
The first firewall policy should only trigger SAML authentication.
After successful authentication, no services should be accessible through this rule.
Once authenticated, subsequent policies should apply access rules for the authenticated user/group.
To achieve this, we created an authentication-only policy with the following configuration:
Source: all
Destination: Internet Services
Internet Services used:
Microsoft-Azure
Microsoft-Azure.Front.Door
Microsoft-Office365.Published
After applying this configuration, SAML authentication works correctly when the authentication process is triggered.
However, we are facing the following issue:
When users open a browser and try to access Microsoft-related services (for example: office.com, outlook.com, etc.), the SAML authentication page does not appear.
The browser waits for some time and eventually the webpage loads as a blank page.
At this stage:
The SAML login prompt never appears.
The user remains unauthenticated.
The user cannot access any services.
Expected Behavior
When a user tries to access Microsoft services or any internet resource, the FortiGate should redirect the user to the SAML authentication portal, and after successful authentication, the appropriate firewall policies should be applied.
Actual Behavior
The SAML authentication page is not triggered, resulting in a blank page and no connectivity for the user.