New Member

Question

SAML Hybrid Azure Join Implementation | Fortigate | Forticlient EMS

Forum|Forum|9 months ago
August 19, 2025
5 replies
1980 views

Hello Team,

We have integrated the Fortigate with the Forticlient EMS along with Azure IdP for MFA authentication. The forticlient gets connected and Azure IdP with MFA is also working as expected.

Now we are trying to implement Hybrid Azure AD Joined, we are experiencing an issue where FortiClient is not able to recognize that laptop is Hybrid Azure AD Joined, even after the Hybrid Join feature has been enabled in the Conditional Access policy in Azure Active Directory.

Also, we have followed the below link and check the mark the check on Use External Browser as user-agent for saml user authentication, but its not working.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Implementing-device-based-Conditional-Access/ta-p/267878

Anyone can help on this?

muhammadsaadAuthor

New Member

Hi,

Anyone can guide and help out.

Thanks

FortiDor

Explorer II

Hello @muhammadsaad

Indeed you need to setup the "User External Browser" in your FortiClient settings file to be able to be detected by the Conditional Access of Microsoft.

Are you using the free FortiClient VPN or the EMS version deployed on your computers ?

What is the FortiClient version used ?

Be aware to check the Azure logs to know why the Conditional Policy is not matching.

muhammadsaadAuthor

New Member

We are using the Forticlient VPN having version 7.4.3 and its integrated with our EMS.

The user external browser settings is also done and when we press the button "Connect" on the forticlient, its appears a pop up on right side (Unknown error).

The link that i had shared earlier, we have followed that. Kindly help us out further. As per my understanding, the EMS profile which is pushed on the forticlient, on that the issue is occuring and Hybrid Azure IdP Joined concept is not working.

muhammadsaadAuthor

New Member

It would be nice if some one help out on this

funkylicious

SuperUser

I would open a TAC ticket if you did not do that already.

Not everyone here has access to Azure in order to try and replicate the issue in order to provide assistance.

"jack of all trades, master of none"

muhammadsaadAuthor

New Member

Can you please help me out who will help us on this case?
Fortigate Support or EMS Support?

funkylicious

SuperUser

https://community.fortinet.com/t5/Customer-Service/Technical-Tip-How-to-create-a-ticket-for-Fortinet-TAC/ta-p/330199

EMS Support i think could help, if not they will transfer it to whatever team is more competent afterwards.

"jack of all trades, master of none"

muhammadsaadAuthor

New Member

Its taking a bit longer, I have followed the admin guide and follow the steps of below topic:

"Using a browser as an external user-agent for SAML authentication in an SSL VPN
connection"

Now, when we try to connect the user using EMS pushed remote access profiles on the FortiClient, its giving a notification of unknown error.

Whereas, when we create a manual profile on the forticlient and sends a connection request, its getting re-directed on the browser.

What could be the issue. Can someone help out

Zekeout

Visitor III

I was battling a similar issue for a while (although we are using IPsec vs. SSL) and it is my understanding that SAML using an external browser requires FortiOS 7.6.1 per the below link,

https://docs.fortinet.com/document/fortigate/7.6.1/administration-guide/951346/saml-based-authentication-for-forticlient-remote-access-dialup-ipsec-vpn-clients

I'm not sure how accurate this is, as we are able to use Duo as our IdP with the external browser for SSLVPN connections without any issues. When trying to use Entra as our IdP for IPsec connections, it was not working using the external browser and would throw the "device is not hybrid joined" error message when using the integrated browser.

If you are able to get as far as the "device is not hybrid joined" error message, one idea is to exclude the FortiGate application in Entra from requiring devices to be hybrid joined and configure the EMS serial number verification setting on the firewall - this at least gives you some confirmation that the connecting device is managed by the organization (assuming you only have trusted devices in EMS).

muhammadsaadAuthor

New Member

Hello,

Thanks for your reply.

We are using SSL VPN, The EMS serial number verification settings is already done on the firewall and its working such that if EMS is not connected on the forticlient and we try to connect the VPN, then it denied the access.

The Forticlient version is 7.4.3, Forti OS version is 7.4.8 and Forticlient EMS version is 7.4.1.

When we try to connect the user using EMS pushed remote access profiles on the FortiClient, and then sends a connect request its giving a notification of unknown error.

Whereas, when we create a manual profile on the forticlient and sends a connection request, its getting re-directed on the browser.

Is there any limitations on the Forticlient EMS or some configuration related part is missing? Please advise

Zekeout

Visitor III

No limitations that i am aware of - if you are able to get it working correctly when manually configuring the connection then EMS should be able to do the same. I would review the configuration between the two, something must be different. Double check you have SAML login enabled and External Browser enabled in the advanced settings of the connection profile in EMS.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded