Configure Entra ID SSO for ZTNA authentication

[shawn-ev]

I am starting the process to migrate our SSL-VPN users to ZTNA. We have SSO configured for all SSL-VPN users now. I cannot find any documentation for configuring EntraID as the SSO provider for ZTNA authentication. I have found this reddit post that says it can be done, but all requests for documentation/proof were met with "the site is no longer available" and "I don't have the config anymore", so I'm skeptical.

Has anyone configured Entra ID SSO for ZTNA connections? What is the correct Authentication Sheme config? What are the correct ZTNA Server settings and how do they correlate to the existing SSO for SSL-VPN, e.g., login url, logout url, idp url, etc?

edit: readability, formatting

[Shashwati]

hello

Refer to the document 

https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/461532/ztna-application-gate...

https://docs.fortinet.com/document/fortigate-public-cloud/7.6.0/azure-administration-guide/584456/co...

[shawn-ev]

As I said in my original post, we already have SSO configured for SSL-VPN using Entra ID. This is already working (same as referenced in your second link, which has nothing to do with ZTNA). We have this same SSO config in place on numerous firewalls where we grant specific access to specific user Entra ID user groups. Works great!

I am trying to migrate over to ZTNA. Your first link does not explain how the Entra ID groups are associated to access, and where to put those groups. For example, when configuring SSO for SSL-VPN, I create a User Group object on the firewall, using the Entra ID SSO config, and referencing the Object ID of the Entra ID group. I then identify those groups in firewall rules to allow/deny access. How/where do I "make that connection" for ZTNA.

What do I use for the LDAP server? Do I need a separate LDAP server when using Entra ID SSO for ZTNA?