The first thing we will need to do is create an Enterprise Application within the Azure AD subscription, as this is what the SMAL requests will authenticate against.

After your group is created take a note of the “Object id” as you will need it later.

You will also need to create a group and add the user(s) who will be using the SSL VPN portal as members.

If your user(s) who will be using the SSL VPN portal don’t already exist create them.Troubleshooting Azure AD User(s) and Group.FortiGate Config – User to SSL Portal Mapping.FortiGate Config – Creating an SSL Portal.FortiGate Config – Mapping local group to the Azure AD group.FortiGate Config – Uploading your application certificate.Collecting the details needed for the FortiGate setup.Possibly earlier versions will work too but I personally have not tested. But I have tested and it is pretty much the same for v6.4.6 and works fine on that release for both physical and virtual models. The screenshots are taken from a FortiGate firewall running v7.0.1. This guide will cover the steps followed.

This gives the benefit of the users being able to login using their Azure AD account and you can enforce the use of MFA and other conditions via Condition Access I elected to use a Fortinet FortiGate firewall with an SSL VPN Portal linked via SAML to Azure AD. I recently had the requirement to allow a few accounts remote access to a server via RDP for support purposes.

Fortigate azure vpn