Technical Tip: Configuring SAML SSO login for SSL VPN with Azure AD acting as SAML IdP in FortiManager

[haldahan]

Description	This article describes how to configure SAML SSO login for SSL VPN with Azure AD acting as the SAML IdP in FortiManager and pushing to multiple FortiGates.
Scope	FortiManager, SAML.
Solution	Enable 'CLI Only Objects' under Policy & Objects -> Object Configurations -> Tools -> Display Options. Configure the SAML user. Ensure that identity provider (IdP)-related entries match the Azure-side configuration. Create a User Group under Policy & Objects -> Object Configurations -> CLI Only Objects: Notes: It is also possible to create a User Group under Policy & Objects -> Object Configurations -> CLI Only Objects. 'Config Match' will only appear after creating a User Group. Configure group matching based on Azure Active Directory Group ObjectId. Go to VPN -> SSL VPN Settings. Configure as desired. Go to Policy & Objects. Create a new SSL VPN firewall policy or modify an existing one to apply to the group that contains the SAML user configured in step 3.