Configuring user verification with SAML authentication and an Azure AD server user account

The following provides an example of configuring user verification, using an Azure Active Directory (AD) server for authentication. This configuration consists of the following steps:

1. The EMS administrator adds the Azure AD server to EMS.
2. The EMS administrator creates a SAML configuration in EMS, with EMS as the service provider (SP) and the Azure AD server as the identity provider (IdP).
3. The EMS administrator configures an invitation code, and send the invitation code to the desired user.
4. The end user receives the invitation email, and uses it to download FortiClient.
5. The end user connects to EMS using their Azure AD credentials.

To configure an Azure AD server in EMS:

1. Configure the Azure AD server as an authentication server in EMS:
   1. In the Azure management console, collect your AD tenant ID, client ID, and client secret.
   2. Go to Administration > Authentication Servers.
   3. Click Add > Azure.
   4. In the Tenant ID and Client ID fields, enter the IDs that you collected from the Azure management console.
   5. For Authorization Type, select Client Secret.
   6. In the Client Secret field, enter the client secret that you collected from the Azure management console.
   7. Configure other fields as desired.
   8. Click Test.

      

   9. After the test succeeds, click Save.

To add endpoints using an Azure AD server:

1. Go to Endpoints > Manage Domains.
2. Click Add, then Azure.
3. From the Azure Server dropdown list, select the desired server.
4. In the Sync every field, enter the number of minutes after which EMS syncs with the Azure server.
5. For Group Selection Behaviour, select Import Entire Azure Domain or Import Selected Azure Groups.
6. Enable Import as Base Group for the desired groups, then click Save.

   

   Endpoints > Domains lists the Azure AD server domain groups and subgroups. It lists subgroups as a flat list and does not preserve the hierarchy from the AD server.

To register an Azure AD user's endpoint to EMS using SAML:

1. Create a SAML configuration:
   1. In EMS, go to User Management > SAML Configuration.
   2. Click Add.
   3. For Authorization Type, select LDAP.
   4. From the Domain dropdown list, select the Azure AD server.
   5. In the SP Address field, enter the EMS IP address or FQDN. You can also use the Use Current URL button to populate the field.
   6. Under Identity Provider Settings, enter the Azure AD entity ID and single sign on URLs. Click Save.
2. In the top banner, click Invitations.
3. Click Add.
4. For Verification Type, select SAML.
5. From the SAML Config dropdown list, select the SAML configuration.
6. Configure other settings as desired, then click Save.
7. You can authenticate the endpoint using Azure AD by doing one of the following:
   1. To join the device to the Azure AD server, do the following:
      1. On the endpoint, go to Settings > Accounts.
      2. Under Access work or school, click Connect.
      3. Log in as an Azure AD user.

         

      4. In FortiClient, on the Zero Trust Telemetry tab, enter the invitation code to register to EMS. FortiClient register to EMS as the logged in Azure AD user without additional prompts.
   2. For a workgroup endpoint or an endpoint joined to an on-premise domain, in FortiClient, on the Zero Trust Telemetry tab, enter the invitation code to register to EMS. A Microsoft single sign on prompt displays. Enter the Azure AD user credentials to authenticate and connect FortiClient to EMS.