SAML Hybrid Azure Join Implementation | Fortigate | Forticlient EMS

[muhammadsaad]

Hello Team,

We have integrated the Fortigate with the Forticlient EMS along with Azure IdP for MFA authentication. The forticlient gets connected and Azure IdP with MFA is also working as expected. 

Now we are trying to implement Hybrid Azure AD Joined, we are experiencing an issue where FortiClient is not able to recognize that laptop is Hybrid Azure AD Joined, even after the Hybrid Join feature has been enabled in the Conditional Access policy in Azure Active Directory. 

Also, we have followed the below link and check the mark the check on Use External Browser as user-agent for saml user authentication, but its not working.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Implementing-device-based-Conditional-Acce...

Anyone can help on this?

[muhammadsaad]

Hi,

Anyone can guide and help out.

Thanks

[FortiDor]

Hello @muhammadsaad 

Indeed you need to setup the "User External Browser" in your FortiClient settings file to be able to be detected by the Conditional Access of Microsoft.

Are you using the free FortiClient VPN or the EMS version deployed on your computers ?

What is the FortiClient version used ? 

Be aware to check the Azure logs to know why the Conditional Policy is not matching.

[muhammadsaad]

We are using the Forticlient VPN having version 7.4.3 and its integrated with our EMS. 

The user external browser settings is also done and when we press the button "Connect" on the forticlient, its appears a pop up on right side (Unknown error).

The link that i had shared earlier, we have followed that. Kindly help us out further. As per my understanding, the EMS profile which is pushed on the forticlient, on that the issue is occuring and Hybrid Azure IdP Joined concept is not working.

[muhammadsaad]

It would be nice if some one help out on this

[funkylicious]

I would open a TAC ticket if you did not do that already.

Not everyone here has access to Azure in order to try and replicate the issue in order to provide assistance.

[muhammadsaad]

Can you please help me out who will help us on this case?
Fortigate Support or EMS Support?

[funkylicious]

https://community.fortinet.com/t5/Customer-Service/Technical-Tip-How-to-create-a-ticket-for-Fortinet... 

EMS Support i think could help, if not they will transfer it to whatever team is more competent afterwards.

[muhammadsaad]

Its taking a bit longer, I have followed the admin guide and follow the steps of below topic:

"Using a browser as an external user-agent for SAML authentication in an SSL VPN
connection"

Now, when we try to connect the user using EMS pushed remote access profiles on the FortiClient, its giving a notification of unknown error.

Whereas, when we create a manual profile on the forticlient and sends a connection request, its getting re-directed on the browser.

What could be the issue. Can someone help out

[Zekeout]

I was battling a similar issue for a while (although we are using IPsec vs. SSL) and it is my understanding that SAML using an external browser requires FortiOS 7.6.1 per the below link,

https://docs.fortinet.com/document/fortigate/7.6.1/administration-guide/951346/saml-based-authentica...

I'm not sure how accurate this is, as we are able to use Duo as our IdP with the external browser for SSLVPN connections without any issues. When trying to use Entra as our IdP for IPsec connections, it was not working using the external browser and would throw the "device is not hybrid joined" error message when using the integrated browser. 

If you are able to get as far as the "device is not hybrid joined" error message, one idea is to exclude the FortiGate application in Entra from requiring devices to be hybrid joined and configure the EMS serial number verification setting on the firewall - this at least gives you some confirmation that the connecting device is managed by the organization (assuming you only have trusted devices in EMS).