SAML SSO with Azure AD as IdP

You can configure a single sign on (SSO) connection with Azure Active Directory (AD) via SAML, where Azure AD is the identity provider (IdP) and FortiClient EMS is the service provider (SP). This feature allows users to log in to EMS by logging in with their Azure AD credentials.

To configure FortiClient EMS with Azure AD SSO:

In FortiClient EMS, go to Administration > SAML SSO. Service Provider Settings displays the SP Address, SP Entity ID, and SP ACS (login) URL fields. You use these values to configure FortiClient EMS as an SP in Azure. Copy these values.
Create and configure your FortiClient EMS environment in Azure:
1. In the Azure portal, go to Azure Active Directory > Enterprise applications > New application.
2. Search for and select FortiClient EMS.
3. Click Create.
4. Assign Azure AD users and groups to FortiClient EMS.
5. Go to Set up single sign on.
6. For the SSO method, select SAML.
7. In Basic Configuration, enter the values that you copied in step 1. The following summarizes the mapping between EMS fields and Azure fields:
  EMS Service Provider Settings field
  Azure AD Basic SAML configuration field
  SP Entity ID
  Identifier (Entity ID)
  SP ACS (login) URL
  Reply URL (Assertion Consumer Service URL)
  SP Address
  Sign on URL
Obtain the IdP information from Azure:
1. The SAML Signing Certificate box contains links to download the SAML certificate. Download the certificate.
2. The Set up <FortiClient EMS instance name> box lists the IdP information that you must provide to FortiClient EMS. Copy the values in the Login URL and Azure AD Identifier fields.
Configure the IdP information in FortiClient EMS:
1. In EMS, under Identity Provider Settings, In the IdP Entity ID and IdP single sign-on URL fields, paste the values that you copied from the Azure AD Identifier and Login URL fields, respectively.
2. From the IdP Certificate dropdown list, select Create, then upload the certificate that you downloaded. Click Next.
Review the SAML configuration, then click Save.

EMS Service Provider Settings field	Azure AD Basic SAML configuration field
SP Entity ID	Identifier (Entity ID)
SP ACS (login) URL	Reply URL (Assertion Consumer Service URL)
SP Address	Sign on URL

SAML SSO with Azure AD as IdP

To configure FortiClient EMS with Azure AD SSO:

In FortiClient EMS, go to Administration > SAML SSO. Service Provider Settings displays the SP Address, SP Entity ID, and SP ACS (login) URL fields. You use these values to configure FortiClient EMS as an SP in Azure. Copy these values.
Create and configure your FortiClient EMS environment in Azure:
1. In the Azure portal, go to Azure Active Directory > Enterprise applications > New application.
2. Search for and select FortiClient EMS.
3. Click Create.
4. Assign Azure AD users and groups to FortiClient EMS.
5. Go to Set up single sign on.
6. For the SSO method, select SAML.
7. In Basic Configuration, enter the values that you copied in step 1. The following summarizes the mapping between EMS fields and Azure fields:
  EMS Service Provider Settings field
  Azure AD Basic SAML configuration field
  SP Entity ID
  Identifier (Entity ID)
  SP ACS (login) URL
  Reply URL (Assertion Consumer Service URL)
  SP Address
  Sign on URL
Obtain the IdP information from Azure:
1. The SAML Signing Certificate box contains links to download the SAML certificate. Download the certificate.
2. The Set up <FortiClient EMS instance name> box lists the IdP information that you must provide to FortiClient EMS. Copy the values in the Login URL and Azure AD Identifier fields.
Configure the IdP information in FortiClient EMS:
1. In EMS, under Identity Provider Settings, In the IdP Entity ID and IdP single sign-on URL fields, paste the values that you copied from the Azure AD Identifier and Login URL fields, respectively.
2. From the IdP Certificate dropdown list, select Create, then upload the certificate that you downloaded. Click Next.
Review the SAML configuration, then click Save.