Configuring user verification with Azure AD authentication

The following provides an example of configuring user verification using an Azure Active Directory (AD) server for authentication. This configuration consists of the following steps:

1. The EMS administrator adds the Azure AD server to EMS.
2. The EMS administrator configures an invitation code and sends it to the desired user.
3. The end user receives the invitation email, and uses it to download FortiClient.
4. The end user connects to EMS using their Azure AD credentials.

To configure an Azure AD server in EMS:

1. Configure the Azure AD server as an authentication server in EMS:
   1. In the Azure management console, collect your AD tenant ID, client ID, and client secret.
   2. Go to Administration > Authentication Servers.
   3. Click Add > Azure.
   4. In the Tenant ID and Client ID fields, enter the IDs that you collected from the Azure management console.
   5. For Authorization Type, select Client Secret.
   6. In the Client Secret field, enter the client secret that you collected from the Azure management console.
   7. Configure other fields as desired.
   8. Click Test.

      

   9. After the test succeeds, click Save.

To add endpoints using an Azure AD server:

1. Go to Endpoints > Manage Domains.
2. Click Add, then Azure.
3. From the Azure Server dropdown list, select the desired server.
4. In the Sync every field, enter the number of minutes after which EMS syncs with the Azure server.
5. For Group Selection Behaviour, select Import Entire Azure Domain or Import Selected Azure Groups.
6. Enable Import as Base Group for the desired groups, then click Save.

   

   Endpoints > Domains lists the Azure AD server domain groups and subgroups. It lists subgroups as a flat list and does not preserve the hierarchy from the AD server.

To create an invitation code:

1. Go to User Management > Invitations.
2. Click Add.
3. Configure the invitation:
   1. In the Name field, enter the desired invitation name.
   2. For Type, select Individual.
   3. Enable Send Email Notifications.
   4. In the Email Recipients field, enter the desired user email address.
   5. In the Include FortiClient Installer field, add a FortiClient deployment package. The email that the user receives includes a link to download this deployment package.
   6. If desired, use the Expiring and Expiry Date fields to set an expiry date for this invitation.
   7. For Verification Type, select LDAP.
   8. From the LDAP Domain User dropdown list, select the desired domain user. This option is available when configuring an invitation to send to an individual. When configuring a bulk invitation, you select an LDAP domain instead of a domain user.
4. Click Save.

To register an Azure AD user's endpoint to EMS using an invitation code:

1. In the EMS top banner, click Invitations.
2. Click Add.
3. For Verification Type, select Domain.
4. From the LDAP Domain dropdown list, select the Azure AD server.
5. Configure other settings as desired, then click Save.
6. On the endpoint, go to Settings > Accounts.
7. Click Join this device to Azure Active Directory.
8. Under Access work or school, click Connect.
9. Log in as an Azure AD user.

   

10. In FortiClient, on the Zero Trust Telemetry tab, enter the invitation code to register to EMS. FortiClient register to EMS as the logged in Azure AD user without additional prompts.