Technical Tip: Migrating Sub-Users to IAM Users in FortiCloud - FortiSASE error message ‘user login failed’

jiahoong112 · ‎09-11-2024

Description

This article describes that logging into the FortiSASE instance results in an error message, ‘user login failed’.

This is because of the recent change as per https://status.fortisase.com where sub-users have been deprecated in FortiCare/FortiCloud so they have to be migrated to IAM users:

It is advisable to ‘SUBSCRIBE TO UPDATES’ on the FortiSASE Status page. The migration from sub-user to IAM user can only be done through the Master Account.

Scope

FortiSASE, FortiCloud.

Solution

Log into the Fortinet Support Portal (support.fortinet.com) using the master account. Go to Services -> IAM.
Create a new Permission Profile, give the permission portal a name, Select Type as Organization and select Add Portal. Grant access and permissions to the following categories, the rest can also be included. Select Submit to apply the setting.

Note: The default SysAdmin permission profile will not work.

Screenshot 2024-09-26 143508.png

Create a User Group. Go to User Groups -> Add IAM User Group. Give the user group a name and select the Permission Profile that was just created.

Select Next until the Confirm button can be selected.

Select Migrate Sub Users and follow this link: Migrating sub users
Over here, be sure to select Yes under ‘Do you want your permission controlled by an IAM User Group?’.

After migration, a password reset link must be Generated for each newly migrated sub-user and it will be necessary to reset the password that way. Go to Users and select the user. Browse to the Security Credentials tab and select Generate. Send the user the link so that it is possible to reset the password. This step has to be done or otherwise, it will not be possible to log into the IAM user account. Refer here: Adding IAM users.
After completing the steps above, log into the Fortinet Support Portal/FortiCloud, etc as an IAM User.
The IAM account ID can be found here (only the number is required):

After the above is set, the users will be able to log into the accounts. By default, 2FA token delivery will be done via Email but FortiToken can be used too. After migrating to the IAM user, follow this link to use FortiToken for 2FA again: Enabling Two-Factor Authentication.