topic GlobalProtect Azure/SAML MFA prompt everytime a user logs in in GlobalProtect Discussions

GlobalProtect Azure/SAML MFA prompt everytime a user logs in

asiewert — Thu, 16 May 2024 16:42:42 GMT

We have setup Globalprotect to connect to EntraID using SAML. Our goal is to have the user get prompted to enter in MFA everytime they connect to the GlobalProtect portal. How can I do this?

Re: GlobalProtect Azure/SAML MFA prompt everytime a user logs in

TomYoung — Thu, 16 May 2024 22:50:20 GMT

Hi @asiewert ,

I believe the default authentication cookie lifetime in Entra is 90 days. I think these are the steps to change it for your PANW GP application in Entra.

Enterprise Applications > open your GP app
Protection > Conditional Access
New Policy
Access controls > Session
Sign-in frequency > Periodic reauthentication

https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-session-lifetime

I would not set it to 0 as cookie authentication is actually used by Entra (not PANW) for the gateway. That keeps users from being prompted for MFA by the portal and gateway. If you want Entra to prompt them every time, 5 minutes should be good.

Thanks,

Tom

Re: GlobalProtect Azure/SAML MFA prompt everytime a user logs in

asiewert — Wed, 22 May 2024 15:19:25 GMT

I think the session sign-in frequency is key! I believe this is working for us now. Have not tested it extensively, but every time a user logs into GlobalProtect, EntraID will prompt them for multifactor now.