Description
This article describes the new settings required for SSL VPN Azure AD Auto Connect when FortiGate is running v7.4.2 or higher.
Starting with v7.2.1, Azure AD domain joined machines are capable of automatically connecting to an SSL VPN tunnel as per the document below:
Autoconnect for SSLVPN on logging in as an Entra ID user
Starting with FortiClient v7.2.3 and v7.4.2, the Auto-Connect for AZURE AD domain joined machines can be leveraged for IPsec Remote Access tunnels as per the documents below:
Autoconnect for IPsec VPN on logging in as an Entra ID user
Support autoconnect to IPsec VPN using Entra ID logon session information
However, because of the IPsec implementation, the settings below used for the SSL VPN Auto-Connect feature were removed.
config user saml
edit "azure_saml"
set auth-url "https://graph.microsoft.com/v1.0/me"
next
end
Without this setting in place in v7.4.2, users would fail to authenticate using the Auto-Connect feature using Entra ID login session information.
Scope
FortiGate v7.4.2+, Azure AD joined machines, Azure Auto Connect
Solution
To resolve the issue, the settings below must be configured in FortiGate. There are no other changes required in FortiClient:
config user external-identity-provider
edit "azure"
set type ms-graph
set version v1.0
next
end
The next step will be to assign this newly created external-identity-provider to the existing user group as in the example below.
Note:
This must be done via CLI as it is currently not supported by GUI.
config user group
edit "SAML-AZURE-Escalations-AUTO"
set member "azure"
config match
edit 1
set server-name "azure"
set group-name "d4829628-fd49-4e6b-8d9d-85ef5d180447"
next
end
next
end
Note:
To have users connecting via both Auto-Connect with Entra ID login session information and SAML with manually input credentials, then append the external-identity-provider to the existing group as per the example below, where 'azure-saml-sslvpn' is the existing SAML server configured in FortiGate.
config user group
edit "SAML-AZURE-Escalations-AUTO"
set member "azure" "azure-saml-sslvpn"
config match
edit 1
set server-name "azure"
set group-name "d4829628-fd49-4e6b-8d9d-85ef5d180447"
next
edit 2
set server-name "azure-saml-sslvpn"
set group-name "d4829628-fd49-4e6b-8d9d-85ef5d180447"
next
end
next
end
Configuration from FortiClient EMS remains unchanged as per the example below.
