SAML - Integration - Globalprotect Azure-AD-EntraID - Policy Based Groups Azure-AD for GP Zone

[Metgatz]

SAML - Integration - Globalprotect Azure-AD-EntraID  - Policy Based Groups Azure-AD for GP

Hello Live community, how's it going? I hope it's going well.

I have a question, today we have via GP the integration with Azure-AD Entra ID, via SAML, where everything works correctly.

At the level of what is the assignment of groups, we already assigned several groups in the enterprise application, where you read who or who can log in via GP, now the big question.

Is it feasible to make group based policies, ie:

GP source zone - destination DMZ01 Azure Source Group: IT01

I.e. Azure Group-AD IT01@contoso.com , another with SEC01@contos.com Infra@contoso.com.

This to avoid having to make policies, user, by user, to reach and filter the destinations.

Is this feasible ?

There is no AD-Onprem.

Thank you I remain attentive

Best regards

[BPry]

@Metgatz,

Look into the Cloud Identity Engine, it's the answer to this exact problem.