O365 MFA with vpn

Hi

I've spend already quite some time to figure this out, sslvpn with O365 as mfa.

There are some resources of Fortinet :

https://docs.fortinet.com/document/fortigate/6.2.0/azure-cookbook/584456/configuring-saml-sso-login-for-ssl-vpn-web-mode-with-azure-ad-acting-as-saml-idp

https://kb.fortinet.com/kb/php/search.do?cmd=displayKC&docType=kc&externalId=FD45699&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=124732442&stateId=1%200%20124730913%27)

But as most of kb's it's not 100% clear.

First of al does it work or not?

This is somewhat my config:

edit "ssl-azure-saml"         set cert "Fortinet_Factory"         set entity-id "https://fortigateip/remote/saml/metadata"         set single-sign-on-url "https://fortigateip/remote/saml/login"         set single-logout-url "https:/fortigateip/remote/saml/logout"         set idp-entity-id "https://sts.windows.net/idddddad744f487/"         set idp-single-sign-on-url "https://login.microsoftonline.com/idddddad744f487/saml2"         set idp-single-logout-url "https://login.microsoftonline.com/common/wsfederationwa=wsignout1.0"         set idp-cert "AZURE_FGAUTH"         set user-name "username" --> tried with and without     next end

Attached the azure AD config.

And is the default Office 365 E3 subscription enough? That's also not clear to me.

thx for any input!