DOCUMENT LIBRARY

FortiGate / FortiOS

FortiManager

FortiAnalyzer

Admin Guide

Introduction
Licensing and availability
- Subscription licensing
- Free licenses
- SMS licensing
- Email notification on license balance status
Support for EU GDPR
Architecture
Acronyms and abbreviations
Quickstart guide
- Getting started—FGT-FIC users
- Getting started—FAC-FIC users
Main features
Compatibility
- Compatible Fortinet applications
- Supported browsers
Important notes
- Trial account API request limit
- The same token for the same user on multiple applications
- A single FIC user in multiple applications
- Admin accounts and realms
- Supported OTP hard tokens
- Supported FIDO security key
- No SMS MFA with FAC as LDAP server
- FAC users' name issues on FIC GUI
- How to use FortiClient
- Enabling/Disabling FIC end-users on FortiGate
- Account disablement and closure
FortiToken Mobile
- Supported FortiToken Mobile apps
- Activating FTM tokens
- Activating third-party tokens
- Using FTM tokens
Use cases
- One Token shared by different applications
- Changing separate tokens to a single token
- Independent token
- Auto-Alias features—using the same email address
- Splitting user quota among different realms
- FIC account lockout (2FA)
- Managing access to FIC
- Controlling risky conditions
- Synchronizing LDAP remote users in wildcard user group from FortiGate
- Transferring devices on FIC
- ZTNA HTTPS access proxy with FIC MFA
- Adding FIC MFA to remote access IPsec VPN
- Configuring FIC as Microsoft Entra external authentication service provider
- MFA authentication context handling
- Configuring FIC as the IdP proxy for FortiSASE
- FortiIdentity Cloud as OIDC provider
Maintenance
- Adding, syncing, and deleting users
- Adding, syncing, and deleting applications (FortiProducts)
- Service debugging
Applications
- Creating FortiProduct applications
- Transferring application (FC account lockout)
- Replacing an old FortiGate with a new one
- Applications in HA mode
- Applications for third-party usage
FortiCloud
- Logging into an OU account
- Launching FortiIdentity Cloud
FortiIdentity Cloud GUI
Dashboard
- Monitoring FIC status
- Pagination for accounts with multiple sub-admin users
Managing users
- Onboarding users
- Batch-adding users
- Enabling Auto-alias by Email
- Adding user aliases
- Auto-assigning FTKs to selected users
- Getting a new FTM token
- Hiding/showing full FortiAuthenticator username
- Viewing a user's applications
- Using a temporary token
- Editing a user
- Deleting users from FIC
Managing admin groups
- Creating a sub-admin group
- Adding users to the admin group
- Adding realms to the admin group
- Editing sub-admin group configuration
- Deleting a sub-admin group
FortiProducts
- Editing a FortiProduct
- Viewing additional information about an application
- Deleting a FortiProduct
- Assigning a FortiProduct to a realm
- Managing realms
Web Applications
- Adding a web app
- Regenerating API credentials
- Editing a web app
- Deleting a web app
- Configuring secret rotation policy
- Configuring per-SP authentication settings
Management Applications
- Creating a management application
- Regenerating management application secret
- Deleting a management application
SCIM client integration
- Features and benefits
- Supported SCIM client applications
- Use case
- Integrating FIC with SCIM clients
- Demo configurations
- Known issues and special notes
Using SSO applications
- Use Cases
- Configuring per-SP authentication settings
- OIDC Parameters
Adding user source
- Using Google social login as user source
- Support for LDAP/AD user source
Managing End-User Portal
- Configuring End-User Portal
- Configuring IdP user source
- Keeping SSO applications off End-User Portal
Configuring domain mapping
Managing device ownership
- Validating device ownership
- Transferring devices
- Transferring devices on FIC
- Managing device transfer
- Performing factory reset
Managing HA clusters
- Searching for a standalone device
- Adding devices to a cluster
- Moving devices between clusters
- Removing devices from a cluster
Using mobile tokens
Using hardware tokens
Using passkeys
Session monitor
Logs
- Usage data
- Authentication logs
- Management logs
- SMS logs
- Order logs
Using templates
- Creating a custom template
- Editing a template
- Using templates
- Deleting a template
- Alarms
  - Creating a user quota alarm
  - Creating an SMS credit balance alarm
Managing custom branding
- Creating an SSO application branding theme
- Creating an End-User Portal branding theme
- Applying custom branding theme to SSO application
- Applying custom branding theme to End-User Portal
- Deleting a branding scheme configuration
Managing global settings
- Multi-Realm Mode
- Share-Quota Mode
- Account Disable/Delete Notification
- Auto-Create Application
- Username Case & Accent Sensitive
Managing realm settings
- General settings
  - Enabling Auto-alias by Email
- Authentication scheme
- FTM MFA settings
- Email MFA settings
- SMS MFA settings
- Managing password policy
- Managing user verification
Alarm routing
- Configuring receiver groups
- Configuring receivers
Adaptive authentication
- Viewing adaptive authentication policies
- Creating an adaptive authentication policy
  - Creating a Bypass MFA policy
  - Creating an impossible-to-travel policy
- Editing an adaptive auth policy
- Deleting an adaptive auth policy
- Viewing adaptive auth profiles
- Creating an adaptive authentication profile
- Applying adaptive authentication profiles
- Editing an adaptive auth profile
- Deleting an adaptive authentication profile
Managing certificates
FortiOS CLI commands for FortiIdentity Cloud
- Global system configuration
- Accessing FIC management commands
- Configuring admin users
- Configuring local users
- Configuring local LDAP users for FIC service
- Configuring wildcard LDAP users for FIC service
- Configuring local RADIUS users for FIC service
- Diagnosing FortiIdentity Cloud
- Showing user ldap
Licenses
- Licenses
- Purchasing licenses with FortiPoints
Product documentation
FAQs
Release history
Technical support
Change log

Home FortiIdentity Cloud Admin Guide

Accessing FIC management commands

This global command enables you to access the following command options to manage FIC service on your FortiGate.

FG101ETK00000000 #  execute fortitoken-cloud ?
new       Send new activation code for a user.
show      Show service status of this FortiGate.
sync      Synchronize users to FortiIdentity Cloud.
trial     Activate free trial.
update    Update VDOM list to FortiToken Cloud.

FG101ETK00000000 #  execute fortitoken-cloud new ?
<user name>    User name for new token.

FG101ETK00000000 #  execute fortitoken-cloud sync ?
<user type>    {Enter <return> | all | local | remote}

FG101ETK00000000 #  execute fortitoken-cloud trial ?
<Enter>

FG101ETK00000000 #  execute fortitoken-cloud update
<Enter>

The # execute fortitoken-cloud show command yields the FIC service status of the FortiGate, which can be one of the following:

Licensed—The FortiGate has a valid FIC service license.
Service ready—The FortiGate is ready for FIC service.
Service balance—The remaining FIC account balance in terms of credits, for example, 11474.40 credits.

The execute fortitoken-cloud update command sends an updated list of VDOM names to FortiIdentity Cloud so that they can be assigned to realms on the FortiIdentity Cloud portal.

Accessing FIC management commands

This global command enables you to access the following command options to manage FIC service on your FortiGate.

FG101ETK00000000 #  execute fortitoken-cloud ?
new       Send new activation code for a user.
show      Show service status of this FortiGate.
sync      Synchronize users to FortiIdentity Cloud.
trial     Activate free trial.
update    Update VDOM list to FortiToken Cloud.

FG101ETK00000000 #  execute fortitoken-cloud new ?
<user name>    User name for new token.

FG101ETK00000000 #  execute fortitoken-cloud sync ?
<user type>    {Enter <return> | all | local | remote}

FG101ETK00000000 #  execute fortitoken-cloud trial ?
<Enter>

FG101ETK00000000 #  execute fortitoken-cloud update
<Enter>

The # execute fortitoken-cloud show command yields the FIC service status of the FortiGate, which can be one of the following:

Licensed—The FortiGate has a valid FIC service license.
Service ready—The FortiGate is ready for FIC service.
Service balance—The remaining FIC account balance in terms of credits, for example, 11474.40 credits.

The execute fortitoken-cloud update command sends an updated list of VDOM names to FortiIdentity Cloud so that they can be assigned to realms on the FortiIdentity Cloud portal.

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

Web Application / API Protection

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

All Products

Admin Guide

Accessing FIC management commands

Accessing FIC management commands

Accessing FIC management commands

Accessing FIC management commands