using Azure MFA with Global Protect

[Dylanroehrig]

Hello,

To configure Global Protect to use our already Existing MS MFA server, I followed this KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClkkCAC 

I think I had to do one or two extra things as well, but in any case it's working.  However, it only prompts for the second factor if after I disconnect the Global Protect client, I go to Settings and click Sign Out.  If I don't sign out, when I reconnect, I am not prompted for the second factor.  Is this on some kind of timer or something?  I tried putting the machine to sleep, logging out, and rebooting it but none of those things caused it to prompt. Is there a way to get it to require the second factor every time I reconnect?

[Andre.Tsoy]

Hi,

I am trying to get this conditional policy setup to work with the Palo Alto GlobalProtect enterprise app. For some reason O365 is not letting me create it - it hangs. Would you mind sharing your settings with us?

Thanks

[Sabjul]

Hi, thanks for your share, but after testing this i have a question :

- When the user disconnect globalprotect and reconnect it's ok. Connection with MFA is re ask..

- When the shutdown the pc without disconnect globalprotect, after the reboot it can connection globalprotect automatically.. (No password ot MFA is asking..)

Do you have the same thing ? Have find a solution ?

Thanks,

[goepfrichb]

Yes, I have the same thing. The best that I have found is setting 60 minutes to re-require an authentication. After 60 minutes of their initial authorization, it will require a password and MFA again. 

[Sabjul]

To do that tou have configure a conditional access rule in Azure ? 

I've done a condictionnal rule and it's works !! 

Too bad I would have preferred a disconnection to closing the post and sending a logout request.

[goepfrichb]

Yes conditional access is what I did. If you find a way to require password and MFA upon disconnect, please let me know. I haven't been able to find anyway to do that yet.

[Sabjul]

May be it's a new feature, ask GP to send a logout (like the user click on disconnect ) when the Computer reboot or shutdown and the tunnel is already up...

Perhaps a case to palo in order to do a developpment 😉