topic Re: Global Protect MFA with Microsoft Authenticator in GlobalProtect Discussions

Global Protect MFA with Microsoft Authenticator

zeromahesh — Fri, 19 Aug 2022 02:37:49 GMT

Hi,

I am looking for the way to integrate Global Protect MFA with Microsoft Authenticator App. Please note that I need to local user database of the firewall for the authentication and Microsoft Authenticator App for the second factor.

Please help on this.

Re: Global Protect MFA with Microsoft Authenticator

BPry — Fri, 19 Aug 2022 16:38:20 GMT

@zeromahesh,

I don't think this is going to be possible with Microsoft. Since this is built out as a SAML authentication provider unlike SecurID Access, Okta, Duo, and PingID where you can use the built-in MFA vendor providers.

Re: Global Protect MFA with Microsoft Authenticator

zeromahesh — Fri, 19 Aug 2022 18:22:12 GMT

Hi BPry

Thank you for replying me.. But actually I came across few articles where I thought it is possible.. Please see one the articles below and help me on this..

https://support.nvcc.edu/news/556/multifactor-authentication-mfa-for-globalprotect-vpn-and-retirement-of-cisco-anyconnect-vpn.aspx

Re: Global Protect MFA with Microsoft Authenticator

BPry — Fri, 19 Aug 2022 18:49:38 GMT

@zeromahesh,

The document you referenced is almost certainly relying solely on their Microsoft authentication SAML provider. As stated, your wanting to use local users as the initial factor and then using Microsoft as the secondary.
If you were using one of the built-in MFA vendors available through the firewall what you’re attempting to do isn’t an issue. Microsoft isn’t included in that list though, meaning you have to utilize SAML authentication for this provider. While not impossible to do what your asking, it’s more of a workaround and creates a poor user experience.

I guess what I would be asking myself in your shoes is why I’m using local users as the initial factor. What benefit is that giving you in your configuration, and why aren’t you just using the SAML provider?

Re: Global Protect MFA with Microsoft Authenticator

zeromahesh — Fri, 19 Aug 2022 18:52:28 GMT

Hi Bpry

Can I use OKTA for MFA in Global Protect?

Re: Global Protect MFA with Microsoft Authenticator

2000gtacoma — Mon, 10 Oct 2022 03:32:41 GMT

Just rolled this out using azure and saml to mfa. Also disabled users from approving or denying. Instead a otp must be used. To my knowledge can't do this with a local database using microsoft authenticator.

Re: Global Protect MFA with Microsoft Authenticator

zeromahesh — Mon, 10 Oct 2022 14:57:28 GMT

Thanks for your reply. You can do this with Azure Active Directory P1
license and Microsoft Authenticator. Actually I implemented it.

Re: Global Protect MFA with Microsoft Authenticator

GustavoBou — Wed, 07 Dec 2022 14:33:40 GMT

Hi Zeromahesh

That's nice!!! Can You share the configuration necessary with me? Thank you.

Re: Global Protect MFA with Microsoft Authenticator

zeromahesh — Wed, 07 Dec 2022 16:44:27 GMT

HI Thanks. I will share the demo in my youtube channel Firewall Life.

Re: Global Protect MFA with Microsoft Authenticator

GustavoBou — Wed, 07 Dec 2022 19:18:13 GMT

Hi @zeromahesh

Very good... I dont found this video in your channel, please send the link for me.

Thank you.

Re: Global Protect MFA with Microsoft Authenticator

GustavoBou — Mon, 19 Dec 2022 16:08:35 GMT

@zeromahesh

we are looking forward to your video, need to make this work too...thank you

Re: Global Protect MFA with Microsoft Authenticator

zeromahesh — Thu, 16 Feb 2023 07:58:16 GMT

Hi,

Actually I recorded a demonstration on how to integrate Palo Alto Global Protect with Azure Active Directory with Two Factor authentication. Please check the below YouTube link.

https://youtu.be/GxRdPPsIHH8