using Azure MFA with Global Protect

[Dylanroehrig]

Hello,

To configure Global Protect to use our already Existing MS MFA server, I followed this KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClkkCAC 

I think I had to do one or two extra things as well, but in any case it's working.  However, it only prompts for the second factor if after I disconnect the Global Protect client, I go to Settings and click Sign Out.  If I don't sign out, when I reconnect, I am not prompted for the second factor.  Is this on some kind of timer or something?  I tried putting the machine to sleep, logging out, and rebooting it but none of those things caused it to prompt. Is there a way to get it to require the second factor every time I reconnect?

[goepfrichb]

@minow 
I believe that I have found a solution to the Azure not wanted to re-auth users. Within Azure, we had to create conditional access that has session access control. In this section of the conditional access, we selected Sign-in frequency and set this to 1 hour. (Lowest amount of time we could select). Now it seems to be requiring our users to re-auth every hour if they have disconnected. It is my understanding that this won't cause re-auths to users who are still connected, just users who disconnect and then reconnect. 

Hope this helps. We have cert authentication as well as Azure with Duo MFA. 

[MP18]

Thanks for sharing the info.

Are you using global protect always on method?

[goepfrichb]

We initially were not using the always on. We were just using the on demand. 

I have recently setup and tested the Always on. It works like a charm. Is there something that you are having issues with in particular? 

Sorry I missed this comment over the summer. 

[SShnap]

@goepfrichb 

I found another way to do it..... under: Device --> Authentication profile --> enter azure profile --> under Authentication tab --> check the option "Enable Single Logout" 

this will do the work for logout global protect and azure at the same time

[goepfrichb]

Good to know. Thanks for posting that information. 

[Andre.Tsoy]

Hi,

I am trying to get this conditional policy setup to work with the Palo Alto GlobalProtect enterprise app. For some reason O365 is not letting me create it - it hangs. Would you mind sharing your settings with us?

Thanks

[Sabjul]

Hi, thanks for your share, but after testing this i have a question :

- When the user disconnect globalprotect and reconnect it's ok. Connection with MFA is re ask..

- When the shutdown the pc without disconnect globalprotect, after the reboot it can connection globalprotect automatically.. (No password ot MFA is asking..)

Do you have the same thing ? Have find a solution ?

Thanks,

[goepfrichb]

Yes, I have the same thing. The best that I have found is setting 60 minutes to re-require an authentication. After 60 minutes of their initial authorization, it will require a password and MFA again. 

[Sabjul]

To do that tou have configure a conditional access rule in Azure ? 

I've done a condictionnal rule and it's works !! 

Too bad I would have preferred a disconnection to closing the post and sending a logout request.

[goepfrichb]

Yes conditional access is what I did. If you find a way to require password and MFA upon disconnect, please let me know. I haven't been able to find anyway to do that yet.