FortiClient VPN conflicting with Microsoft Intune

[hflorian]

In our environment, we use FortiClient VPN version 7.0.14.0585. We started researching into the possible benefits of Intune, so I configured enrollment, compliance polices, and a simple BitLocker requirement. Those are the only changes to our Entra/Intune environment that I made. Soon, I had rolled Intune out onto a few computers in our division. One of our employees notified us of issues connecting to the VPN, and we suspected Intune to be at fault. Sure enough, when Intune was removed the issue went away.

Screenshot is attached. When clicking yes, you are brought a blank page with a 300 second time out.

[sharmar]

Hello @hflorian 

If you want to use intune compliance with saml, then make you use the external browser, I believe it doesn't support with internal browser. 

Thank you !! 

[btan · Accepted solution]

As @sharmar mentioned above, if you have Conditional Access Policy checking, you will have to use 'external browser', refer: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Implementing-device-based-Conditional-Acce... 

[hflorian]

Hey, thanks very much.  Looking into what I can do on the Intune side of things.  Our environment uses the free version of FortiClient.

[hflorian]

Microsoft uses PRTs to validate sessions, and the VPN gets in the way of that validation.  The free version of the VPN has a "Enable auto-login with Azure Active Directory" option.  I can't verify functionality right now, but when I start the VPN I no longer get the script error pop-up.

[hflorian]

This was not the solution, and I soon realized the external browser is an option on the free version too.  That is now working.  Thanks everyone!