using Azure MFA with Global Protect

[Dylanroehrig]

Hello,

To configure Global Protect to use our already Existing MS MFA server, I followed this KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClkkCAC 

I think I had to do one or two extra things as well, but in any case it's working.  However, it only prompts for the second factor if after I disconnect the Global Protect client, I go to Settings and click Sign Out.  If I don't sign out, when I reconnect, I am not prompted for the second factor.  Is this on some kind of timer or something?  I tried putting the machine to sleep, logging out, and rebooting it but none of those things caused it to prompt. Is there a way to get it to require the second factor every time I reconnect?

[BPry · Accepted solution]

@Dylanroehrig,

Sounds like you are using cookie auth somewhere in your GP configuration. 

[Dylanroehrig]

Hmm, where is an example of someplace that might be?  I don't recall setting cookie authentication anyplace.

[vsys_remo · Accepted solution]

---

@Dylanroehrig wrote:

Hmm, where is an example of someplace that might be?  I don't recall setting cookie authentication anyplace.

---

--> Global Protect Gateway Configuration --> Agent --> Client Settings --> Configs --> Authentication Override --> Accept Cookie for Authentication Override

[Dylanroehrig]

Sorry, I forgot to come back and mention that i found the cookie settings in the GlobalProtect Portal config. Does it matter if I change it there, on the gateway, or both?