FortiNAC integration with EntraID

[doncacciatoconsuting]

Currently I have a typical Active Directory on-prem setup.

1- Persistent Agent gleans the username from the PC. 

2- NAC is linked to AD and pulls the group info for the user.

3- NAC sends the group tags to the Fortigate for use in FW policy to limit access for certain groups

If we move to EntraID (which does not have directory services), how can we keep this design ?

Is there any kind of workaround ?

Don

[AEK]

I'd see from FortiAuthenticator side if it can help.

Edit: I mean you may explore the possibility to put FAC between FNAC and Entra ID.

[Hatibi]

This feature has been submitted as NFR ID: 0949927 and is being planned to be added in FortiNAC v7.6.3 GA.

This can change however due to engineering priority shifts. 

You can track this through your Fortinet Sales Engineer.

[doncacciatoconsuting]

Is it safe to say that until the new feature request becomes available, there is only 1 option to accomplish my firewall tagging requirement: Purchase and deploy Entra Domain Services ?

[Hatibi · Accepted solution]

Yes, at the moment FortiNAC can use only AD on-premise as native authentication source for Persistent agent, radius or other methods. 

Once Entra ID will be supported in v7.6.3 GA, it will be able to perform authentication and user/group lookup in Entra ID and use that group membership in policies etc..

My suggestion to you is to wait until that version is available and request a Proof of Concept from your Fortinet Sales Engineer. This will confirm that there are no issues and that the feature is stable once it releases. Only after confirming this part then you could purchase and deploy Entra ID in order to proceed with the migration.

[doncacciatoconsuting]

thanks all !