topic Re: User-ID with Azure AD in Integration Discussions

User-ID with Azure AD

GOMEZZZ — Thu, 04 Apr 2019 20:13:14 GMT

Hello,

We have PC's that are only registered inside Azure AAD and managed via Intune they have no connection to the on-prem AD and are connecting via a Wifi zone behind PA to the internet. How can i determine the USER id, without user interaction.

Or do i need Global protect for this and SSO?

Is there someting like a User ID agent for Azure AAD.

Or maybe i can use SAML SSO with Azure AAD for captive portal, can somebody point me to a good article on how to configure this.

Re: User-ID with Azure AD

jhochberg — Thu, 02 May 2019 10:09:13 GMT

Hello,

Thanks for your question! This is an awesome use-case however, it's not one that we natively support at this time. There are other customers that have expressed interest in this capability.

If there's a chance you're running in a hybrid mode and have a Windows Server running AD and synchronizing with Azure AD then, of course, you can use the User-ID agent to communicate with the domain controller. SAML authentication works great with GlobalProtect, but it is not intended for use with User-ID.

If you'd like, you can contact me directly (email is first initial last name - no spaces or hyphens [at] paloaltonetworks[dot]com and provide me with your contact information, I'd be happy to add you to the enhancement request list.

Thanks for reaching out!

Best regards,

-JeffH

Jeff Hochberg | Sr. Systems Engineer - Technical Business Development

Palo Alto Networks | Atlanta, GA | USA

Mobile: 404.432.1112 | www.paloaltonetworks.com

The content of this message is the proprietary and confidential property of Palo Alto Networks and should be treated as such. If you are not the intended recipient and have received this message in error, please delete this message from your computer system and notify me immediately by reply e-mail. Any unauthorized use or distribution of the content of this message is prohibited.

Re: User-ID with Azure AD

GOMEZZZ — Thu, 02 May 2019 20:06:34 GMT

Hi Jeff,

I have dropped you an e-mail with my contact details. To get around this limitation i could maybe user a captive portal and SAML SSO?

In my case these user are all on a seperate segment.

I will have to test this out.

Never the less integrating User-ID with Azure AAD would be a good enhancement.

Re: User-ID with Azure AD

GOMEZZZ — Thu, 11 Jul 2019 20:49:00 GMT

Hi Jeff,

Any idea if this i a feature that will be introduced or palo alto is considering this?

Re: User-ID with Azure AD

bwagstheitguy — Fri, 06 Dec 2019 16:02:29 GMT

I'm in the same boat as FDEMUYTER - all machines being managed via AzureAD/Azure Intune without any AD infra to speak of ( not in Hybrid ). Having to enter a userID kind of breaks the SSO experience IMO. Hoping there is a better way to do this.

Re: User-ID with Azure AD

GOMEZZZ — Fri, 06 Dec 2019 17:53:58 GMT

Hi.

what you could to to get the user id is use global protect client with SAML authentication to azure.

You can connect to internal or external portal and use always on.

Re: User-ID with Azure AD

Trond.Olsen — Fri, 15 May 2020 11:51:36 GMT

Hi. Have there been any updates regarding direct integration with Azure AD? We are looking to move to SaaS infrastructure.

Re: User-ID with Azure AD

GOMEZZZ — Fri, 15 May 2020 15:25:29 GMT

Hi Olson,

No user-id agent for azure directly but you can solve this issue by using global protect and SAML authentication.

It depends on what you need and what is your use-case.

What do you want to accomplish in the end?

You can also look into Prisma.

Re: User-ID with Azure AD

Trond.Olsen — Mon, 18 May 2020 06:56:46 GMT

Hi there

We are currently using UserID in schools to implement internet filtering during exams. The number of students far exceed our VPN tunnel capacity in our Palo Alto firewall so we can't use Globalprotect either. Another issue with Azure AD mentioned elsewhere is that you'll see the public NAT IP externally, so maybe UserID isn't an option at all? Maybe we have to look at alternativ implementation in our Cisco wifi solution.

Re: User-ID with Azure AD

GOMEZZZ — Mon, 18 May 2020 09:15:48 GMT

Hi Olsen,

If you are using Cisco ISE you could try forwarding you logs to a palo alto user id agent configured as a syslog listener.

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/user-id/map-ip-addresses-to-users/configure-user-id-to-monitor-syslog-senders-for-user-mapping

I have not tried it myself but was also something i was thinking about.

Another thing you could to is use an internal portal only without creating a tunnel but only for authentication. This is called a non-tunnel mode gateway. (always on configuration)

https://docs.paloaltonetworks.com/globalprotect/8-0/globalprotect-admin/globalprotect-gateways/globalprotect-gateway-concepts/types-of-gateways

This will require you to deploy global protect to all your clients.

This solution will give you the most accurate solution I think.

I am assuming all your users and computer are in azure ad only? How are your users authenticated on the WIFI?

Re: User-ID with Azure AD

Trond.Olsen — Mon, 18 May 2020 09:23:00 GMT

These are good suggestions! I wasn't aware that Globalprotect could be used for autentication only though license might be an issue with iPad and Chromebook. We might get some consulant advice on Cisco ISE as we discarded it some years ago because concerns around complexity.

Concerning Azure AD we plan to remove our on-premise AD entirely.

Re: User-ID with Azure AD

GOMEZZZ — Mon, 18 May 2020 12:42:57 GMT

Hi,

There are different options for your problem but moving everything to the cloud will need carefull planning and decisions up front.

A good read is also:

https://docs.microsoft.com/en-us/azure/active-directory-domain-services/compare-identity-solutions

Also please have a look into Prisma if you are moving to full cloud.

Re: User-ID with Azure AD

wburnett — Fri, 03 Jul 2020 14:20:31 GMT

I think the bigger picture here needs to be put into perspective:

Microsoft is doing everything that they can do to prevent small business from having any on-site servers or services. This includes breaking most file server functions for office, in favor of one-drive, etc.
Hybrid AD deployments are a disaster for SMB - Why have an AD server on-site that does nothing but remote accounts locally when inTune does as much or more than ADGP when it comes to SMB needs.
With COVID and general WFH and BYOD fewer PCs than ever are physically connected to an AD and forcing VPN connectivity just for policy and password management updates is kind of insane when Office and everything else Microsoft is not communicating with O365.

I find it almost imperative that the LOCAL firewall policy be able apply rules based on AzureAd membership - be it User-ID or some other SSO method. I can tell you that almost every one of my SMB customers is already, or will be completely server-less by the end of the year and all will be AzureAD/Intune managed.

There has to be a better way to put 10-50 users into policy based filtering than hydribd-AD or forcing a VPN connection from the same office that the firewall resides in. That is just insane, especially seeing that often, another VPN is used by client PCs to connect to various SaaS endpoints or hosted services.

This is the new SMB model and Palo Alto really needs to embrace it quickly.

Re: User-ID with Azure AD

trlawren — Thu, 10 Sep 2020 20:05:45 GMT

I agree, this is something that we are planning for in the near future. Palo Alto needs to come up with a solution very quickly.

Re: User-ID with Azure AD

wburnett — Wed, 07 Oct 2020 15:22:54 GMT

Crickets...

Hello Palo Alto -- care to comment about this?

Re: User-ID with Azure AD

mlopez78 — Wed, 31 Mar 2021 18:35:25 GMT

Any replies on this Palo? Plenty of people would like to see this functionality.

Re: User-ID with Azure AD

Housing1 — Wed, 28 Jul 2021 13:34:05 GMT

It's July 2021 , Intune/Microsoft Endpoint Manager isn't going away. People are moving to it. We have moved all of out endpoints to Intune. Palo Alto needs a solution. Is there an update here?

Re: User-ID with Azure AD

GOMEZZZ — Thu, 29 Jul 2021 07:45:48 GMT

Hi Housing1,

As of today I am not aware of any direct integration with Azure AD.(used id agent for azure) If you have Azure Active Directory Domain Services you could get group mappings using ldaps.

https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/authentication/enable-group-mapping.html .

To get the user info you could use a global protect client internal portal for authentication only using SAML. (portal non-tunnel model)

Or you can setup a captive portal with SAML authentication to Azure AD.

Depends on you use case.

I think the best option is to use global protect client. For windows laptops no license is needed only for mobile endpoints and linux clients.

Re: User-ID with Azure AD

AnalysisMan — Mon, 18 Apr 2022 19:34:34 GMT

Hello PAN team,

Were there any updates about supporting Azure AAD for User-ID since Jeff Hochberg commented in 2019?

Thanks,

Re: User-ID with Azure AD

PMCHelpdesk — Tue, 17 May 2022 13:16:58 GMT

Bump. Any update to this, 3 years now, this is a major problem now?