Technical Tip: SSL VPN with Azure SAML authentication with multi-factor authentication (MFA)

[ssriswadpong]

Description	This article describes SSL VPN with Azure SAML authentication with multi-factor authentication(MFA).
Scope	FortiGate, FortiClient
Solution	Azure Multi-factor authentication can be enabled for SSL VPN with SAML authentication. This can be done by enabling multi-factor authentication on Azure. No additional setting is require on FortiGate. However, it is important to check whether the authentication timeout for remote servers is long enough for the user to authorize the challenge (MFA). The default setting is configured for 5 seconds. This setting is recommended to be changed to 60 seconds as per commands below: # config system global       set remoteauthtimeout 60   end MFA window will be popped out after entering a credential as the below screenshot.   Links to configure MFA for SSLVPN with Azure SAML authentication:  https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-azure-mfa