FGT SSL VPN with Microsoft Authenticator

[FXE_FTNT]

Hi Guys,

Is it possible to directly integrate the on-premise FortiGate with SSL VPN use case to my Microsoft Authenticator to be my 2FA mechanism? Or, should I use a RADIUS server like FortiAuthenticator where the FortiAuthenticator will be the integration point of my FGT, AD, and Microsoft Authenticator? Thank you.

Thanks

[ozkanaltas · Accepted solution]

Hello @FXE_FTNT ,

If you use Azure AD, you can use Microsoft Authenticator with SAML integration directly. But if you want to use Radius, you need to integrate Fortigate into NPS.

You can review these documents.

https://docs.fortinet.com/document/fortigate-public-cloud/7.4.0/azure-administration-guide/517582/co...

https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-nps-extension

[FXE_FTNT]

Thanks again for the help @ozkanaltas 

[justenglabs1]

I am a month late on this thread, but I am wondering if anyone has built this and is comfortable with this in production?  I worked through this with a customer.  We had FGT's, FAC and Azure.  We went through the process of configuring Azure as the SAML Idp and interconnected it to FAC configured as an Sp.  We got it functioning, but it was limited and it had issues.  In order to do this, you need to be working with FortiClient 7.2.x and even with that it is not 100%.  You can confirm a user auth, but that is about it.  TAC said somewhere in the 7.2.x FCT releases more functionality between Azure and Fortinet will be provided.  The biggest limitation we saw was not being able to use computer objects in EMS which was a show stopper.