FortiAuthenticator vs. M365 vs. Other MFA Options

[piven8]

I’m helping a small business set up MFA to meet cybersecurity insurance requirements they’ll be subject to soon. They have one location and are a heavy Fortinet shop. FortiGate, FortiSwitches, FortiAPs, FortiRecorder, etc. They are also a Microsoft shop with a handful of servers, on-prem AD domain controller, Microsoft 365, and Azure AD Connect cloud sync to sync user accounts. They are generally willing to spend to get the right technology to run their business, so cost isn’t a big concern here. They have around 30 user accounts. To meet the new MFA requirement, would you do FortiAuthenticator, use Microsoft 365’s MFA capabilities, or do something else entirely? Two more bits of info: some users exist in on-prem AD but not M365, and the on-prem AD isn’t going away any time soon because they have it integrated with their Synology, Trane HVAC controls, and something else I’m not thinking of.

[rbraha]

Hi @piven8 

In order to use FAC integration with SAML using Office 365 with MFA ,please check the below documentation 

https://docs.fortinet.com/document/fortiauthenticator/6.5.0/cookbook/878737/office-365-saml-authenti...

For other users that are on premise AD ,you can use SSLVPN authentication with FAC and MFA enabled for AD users , please check the below KB.

https://community.fortinet.com/t5/FortiAuthenticator/Technical-Tip-Guide-to-setting-up-FortiGate-SSL...

[xsilver_FTNT]

 FortiAuthenticator, FAC in short and hereinafter, is definitely step up towards centralized user management and IAM in general.

It could be used to learn users from AD, automatically sync those into FAC and enhance those with FortiTokens automatically assigned to those users. Either HW tokens like 200B model, or Mobile tokens.

It could be set the way it cooperate with O365 and Microsoft Azure and enhance those users with tokens for 2FA authentication. Kindly see the first link @rbraha posted for more details (Docs.fortinet.com and FortiAuthenticator Examples/Cookbook). 
That cookbook contains a lot more.

Besides tokens directly on FAC (or FortiGate [FGT]) you can use:

- FortiToken Cloud solution with pay-as-you-need for just amount of tokens you need

- 3rd party tokens like FIDO tokens, as those could be used in FAC as well

- 3rd party like DUO servers, generally any 2FA/MFA RADIUS based service, as FAC can chain that RADIUS 3rd party MFA into Realm with LDAP, so user credentials will be authenticated against that LDAP, like your MS AD. And upon successful authentication that RADIUS server will be contacted to verify 2nd (additional) factors.
more on Chaining in Admin guide https://docs.fortinet.com/document/fortiauthenticator/6.5.3/administration-guide/485114/realms 

 

[Fincire1945]

Given the unique requirements and setup of your small business, it's important to choose a multi-factor authentication (MFA) solution that integrates easily with your existing infrastructure and provides strong security features. While both FortiAuthenticator and Microsoft 365 offer MFA capabilities, it's important to consider factors such as ease of integration, usability, and overall security.

Given your heavy reliance on Fortinet products and Microsoft services, it may be worth exploring other MFA options that offer greater compatibility and flexibility. One such solution is Protectimus, which specializes in providing comprehensive MFA solutions tailored to different business needs.

Protectimus offers universal MFA solutions that can be easily integrated with a wide range of systems, including on-premises Active Directory, cloud-based Microsoft 365 and other third-party applications. Their solutions are designed to provide strong authentication while ensuring ease of use and minimizing disruption to your workflow.

To learn more about multi-factor authentication (MFA) and explore the right options for your business, I recommend visiting Protectimus at what is mfa. Their expertise in MFA technology and commitment to security will help you make an informed decision and implement a strong authentication solution that effectively meets your cybersecurity insurance requirements. With Protectimus, you can improve the security of your business operations and protect sensitive data from unauthorized access.