How to user grouping on Forticlient IPSec VPN with Azure Entra ID

[LVHan]

I really run out of idea on user grouping based on Azure Entra ID object ID.

I Follow the administration guide to prepare SSL VPN migrate to IPSec VPN with SAML

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/951346/saml-based-authentica...

On phase 1 configuration I face EAP credential error 

config vpn ipsec phase1-interface
    edit "FCT_SAML"
        set eap enable
        set eap-identity send-request
    next
end

Look for lots of tech doc only this work
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Error-EAP-failure-with-IPsec-Dial-Up-VPN-u...

Which mean I had to define the user Group without any Entra Object ID to make user authenticate success or firewall policy with the user group without Entra ID object.

config vpn ipsec phase1-interface
edit IPSec123
set authusrgrp "Azure_IPsec_Empty"
next
end

config user group
edit "Azure_IPsec_Empty"
set member "Azure_IPsec"
next
end

So no issue getting user connect with FortiClient IPSec

diagnose vpn ike gateway list

vd: root/0
name: IPSec123_0
version: 2
interface: port99 
addr: 192.168.20.1:4500 -> 8.8.8.8:14664
tun_id: 10.99.99.1/::10.0.0.4
remote_location: 0.0.0.0
network-id: 0
transport: UDP
virtual-interface-addr: 169.254.1.1 -> 169.254.1.1
created: 39628s ago
eap-user: test@limvuihan.com
2FA: no
peer-id: Testing123
peer-id-auth: yes
FortiClient UID:
assigned IPv4 address: 10.99.99.1/255.255.255.255
nat: me peer
pending-queue: 0
PPK: no
IKE SA: created 1/1 established 1/1 time 180/180/180 ms
IPsec SA: created 1/1 established 1/1 time 0/0/0 ms

id/spi: 148531
direction: responder
status: established 39628-39627s ago = 180ms
proposal: aes256-sha256
child: no
SK_ei:
SK_er:
SK_ai:
SK_ar:
PPK: no
message-id sent/recv: 0/53
QKD: no
lifetime/rekey: 86400/46502
DPD sent/recv: 00000000/00000000
peer-id: Testing123

but .......................

How to match or group user based on ingested Entra object id  ?

if I define any object ID in the user group the EAP authentication will failed so i had to left it blank to make user connect success.

SAML Debug log
samld_send_common_reply [95]: Attr: 10, 41, 'username' 'test@limvuihan.com'
samld_send_common_reply [95]: Attr: 10, 61, 'FortigateGroups' 'abc'
samld_send_common_reply [95]: Attr: 10, 61, 'FortigateGroups' 'xzy'
samld_send_common_reply [95]: Attr: 10, 61, 'FortigateGroups' 'kjh'

config user group
edit "Azure_IPsec_IT"
set member "Azure_IPsec"
config match
edit 1
set server-name "Azure_IPsec"
set group-name "kjh"

config firewall policy
edit 223
set name "RemoteUser_Testing-1"
set srcintf "RemoteUser"
set dstintf "port999"
set action accept
set srcaddr "10.99.99.1"
set dstaddr "1.1.1.1"
set schedule "always"
set service "ALL_ICMP" "SSH" "HTTPS"
set utm-status enable
set logtraffic all
set groups "Azure_IPsec_IT"
next
end

Firewall policy wont work 

p/s
1.  Don't recommend local peer id as user/me has no time to manage it by each department/devices
2. Tried FSSO but there is limitation especial for those BYOD, since is not join domain so wont update netlogon to AD especial VVIP devices.
3. No TAC case is allow as no FortiClient license.
4. Really need interim solution before 7.4 EoE at March 2026. 
5. No IKEv1 ( This feature requires FortiClient 7.2.4 and FortiClient supports only using IKEv2)

[funkylicious]

can you do a, show user saml ?

L.E. I would suggest the following:

- ensure that under config user saml you have for group 

i) either set group-name "group" , if you configured this and use this

ii) either set group-name "http://schemas.microsoft.com/ws/2008/06/identity/claims/groups" , this would be confirmed if required from here

iii) in your case you might use FortigateGroups and require set group-name FortigateGroups ? you would get more clarity about what to configure when you do a debug and see what saml attributes you get.

- in the phase1 , unset authusrgrp and use/create groups based on SAML which you add in firewall rules at the source alongside the ipsec range

https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/727740/using-single-or-multi...