topic Re: We have Entra ID with Global protect works well with SSO but security wants additional MFA in GlobalProtect Discussions

We have Entra ID with Global protect works well with SSO but security wants additional MFA

din100 — Thu, 10 Oct 2024 09:06:28 GMT

We already have the SSO setup with MFA. but security wants us to have a additional MFA.

Is their a way to do this ?

Re: We have Entra ID with Global protect works well with SSO but security wants additional MFA

JayGolf — Wed, 16 Oct 2024 19:11:48 GMT

Do you have 2FA setup for your SSO? Or do users just auth via username/pass creds. On the Azure side, Conditional Access is where you can setup 2FA with DUO/authenticator/RSA

Re: We have Entra ID with Global protect works well with SSO but security wants additional MFA

din100 — Wed, 16 Oct 2024 23:53:52 GMT

yes we have a 2fa with SSO but security wants users to MFA in every time they connect to the VPN. because it's SSO they connect automatically which they think It's not secure 🤕

Re: We have Entra ID with Global protect works well with SSO but security wants additional MFA

TomYoung — Thu, 17 Oct 2024 01:53:03 GMT

Hi @din100 ,

This may be an issue with your Azure cookie settings. Check these posts.

https://live.paloaltonetworks.com/t5/globalprotect-discussions/globalprotect-azure-saml-mfa-prompt-everytime-a-user-logs-in/m-p/586987

https://live.paloaltonetworks.com/t5/globalprotect-discussions/force-user-credentials-at-every-login-azure-ad-saml-sso/td-p/582707

Thanks,

Tom

Re: We have Entra ID with Global protect works well with SSO but security wants additional MFA

din100 — Thu, 17 Oct 2024 07:10:29 GMT

Thank you sorry my search didn't come up with that result

Re: We have Entra ID with Global protect works well with SSO but security wants additional MFA

vte888 — Mon, 21 Oct 2024 05:44:42 GMT

Your security staff or whomever is in control of your VPN configuration, need to test and learn how to get the 2FA/MFA to work properly and turn off the SSO if they feel that is not secure. And then they need to have the patience of saints teaching their users how to install some Authenticator App on a phone so that you all can experience the LOVELY MFA that my company has me going thru... every 24 hours... I have to show my face to my phone... in between it remembers I did it already that day. The stuff works. But it probably is easy to mess up the configuration of it.