Technical Tip: Configure Microsoft Entra ID as the Identity Provider (IDP)

[asrour]

Description	This article describes how to configure a Microsoft Entra ID as the Identity Provider (IDP).
Scope	FortiManager and FortiAnalyzer.
Solution	FortiManager / FortiAnalyzer will be the Service provider(SP). Microsoft Azure will be the identity provider (IdP). In FortiManager: Navigate to System Settings -> SAML SSO -> Single Sign-On Mode: Service Provider (SP). The Server Address is automatically populated, which is the FortiManager management IP address (or FQDN) that will also be used in SP details. When SP is selected, the SP details are generated. In Azure: Sign in to the Azure portal. Search for Enterprise applications. Create a New Application. Edit basic SAML configuration. Azure FortiManager Identifier (Entity ID) SP Entity ID Reply URL (Assertion Consumer Service URL) SP SLS (Logout) URL Relay State (Optional) USER: https://<<fmg_ip>>/p/sso_sp/ Logout Url (Optional) SP SLS (Logout) URL In Azure (Step 2. User Attributes and Claims), add a new claim with the following details: Name: username. Namespace: leave blank. Source: Attribute. Source attribute: user.userprincipalname. Delete the unused attributes. Download the Certificate from Azure (it will be uploaded later to FortiManager). Add the user or security group to the Users and Groups sections, so these users and/or group members can be authenticated. In FortiManager: Copy the values from step 4 into FortiManager IdP settings: Import the certificate that was downloaded earlier. The  'IdP Entity ID' is the Microsoft Entra Identifier in Azure. The next step in FortiManager is to create the admin user. There are three options for Admin users (use any of these options): Auto-Create Admin option in SAML SSO configuration. Select the admin profile that will be assigned to the admin user upon login. In this case, the admin user will be automatically created on FortiManager Create the  SSO Admin in Fortimanager (the auto create admin option should be disabled). To assign a specific profile (super_user, restricted_user ...) based on the Entra ID group:  (FortiManager/FortiAnalyzer v7.4.3/v7.2.6 and higher). Create more than SSO admin with the specified profile and add the group name in advanced ext-auth-group-match: In Azure (Step 2. User Attributes and Claims), add a new claim with the following details: Add a group claim customize the name of the group claim, and set it to 'groupmatch'. Create a generic SSO admin with the Match all users option enabled on the remote server (the auto create admin option should be disabled). In this case, any user that logs in will be logged in as the ssoadmin user. Related article: Technical Tip: SAML SSO - FortiManager/FortiAnalyzer Troubleshooting Options

[saleha]

Great kb thank you for this article

[mimran]

Excellent. Thanks for the detailed steps.