FortiNAC integration with EntraID

Forum|Forum|1 year ago
February 12, 2025
5 replies
3319 views

Currently I have a typical Active Directory on-prem setup.

1- Persistent Agent gleans the username from the PC.

2- NAC is linked to AD and pulls the group info for the user.

3- NAC sends the group tags to the Fortigate for use in FW policy to limit access for certain groups

If we move to EntraID (which does not have directory services), how can we keep this design ?

Is there any kind of workaround ?

Don

FortiNAC

Best answer by Hatibi

Yes, at the moment FortiNAC can use only AD on-premise as native authentication source for Persistent agent, radius or other methods.

Once Entra ID will be supported in FortiNAC new releases, it will be able to perform authentication and user/group lookup in Entra ID and use that group membership in policies etc..

AEK

SuperUser

I'd see from FortiAuthenticator side if it can help.

Edit: I mean you may explore the possibility to put FAC between FNAC and Entra ID.

AEK

Hatibi

Staff & Editor

This is being planned to be added in FortiNAC future releases.

doncacciatoconsutingAuthor

Explorer II

Is it safe to say that until the new feature request becomes available, there is only 1 option to accomplish my firewall tagging requirement: Purchase and deploy Entra Domain Services ?

HatibiAnswer

Staff & Editor

Yes, at the moment FortiNAC can use only AD on-premise as native authentication source for Persistent agent, radius or other methods.

Once Entra ID will be supported in FortiNAC new releases, it will be able to perform authentication and user/group lookup in Entra ID and use that group membership in policies etc..

doncacciatoconsutingAuthor

Explorer II

thanks all !

Sign up

Login with SSO

Login to the community

Login with SSO