We are assuming that Domain Services and LDAPS is properly configured in Azure
On FG, for ldap server, make sure you use port 636
Common Name Identifier: sAMAccountName
Use your DN
Bind type: Regular
Username: use company\username syntax.
If you use username or username@companydomainname it does not work
Secure Connection: selected
Protocol LDAPS
No certificate
Check that the connection is successful and if you are on version 6, test a user credential from there.
No point to carry on, if you connection is not successful
When you create your User group, use the previously created LDAP server.
If like me, you want to restrict access to a particular user group, on your Recursive list, select OU=AADDC Users, and search for your required group. Once found, you need to right click on it to select it.
The next step is the one which tricked me for a couple of days:
When you try Forticlient, it fails to authenticate. Error message is not helping and there is nothing in the logs of interest. Of course, there is nothing either on AzureAD
The change to make it work is as follow on the FG:
config system global
set ldapconntimeout 5000
end
Also, on the Forticlient, username is shortname of UPN. If user uses full UPN it will fail. You can see these attempts in the logs
Good luck
