Add multiple authentication profiles (assigned to different user groups) to Global Protect VPN

[D.Wilson417978]

We are looking to convert our default authentication profile from RADIUS w/DUO MFA to SAML (Azure) w/DUO MFA. The client would like to test the new solution with just the internal IT team while normal users maintain the old authentication method. Is there a way to add a second authentication profile to the Global Protect Gateway & Portal which is only initiated by login accounts within a specific group, while all other users authenticate with the default profile?

[JayGolf · Accepted solution]

Hi @D.Wilson417978 ,

Unfortunately with SAML, you cannot have multiple auth profiles. You can create two separate portals - one portal for internal IT team and the other for normal users.

[BPry]

@D.Wilson417978,

You can split based off of the OS if you have something that you either don't utilize in your environment or can afford to temporarily break for testing. For example if you don't have someone using Chrome as an example, you could test the change on ChromeOS to validate things are working properly before fully making the switch. Same thing would work for any other OS, as long as you have something not being used you could use it to validate without issue.