Defender for Identity VPN log integration

[pfox001]

Hi all,

Has anyone been able to configure a PA firewall to forward Radius messages to a MS Defender for Identity sensor as per Microsoft Defender for Identity VPN integration in Microsoft 365 Defender | Microsoft Docs

We are using Azure AD for Global Protect authentication, so not sure that it's possible to send to Radius if not using it to authenticate?

Cheers,

Paul.

[rlewandowski]

Hi,

I would also like more information on this being a Microsoft Defender for Identity and Palo Alto Networks GlobalProtect VPN customer.

Thank you,

Ryan

[BPry]

@rlewandowski,

This wouldn't be configured directly on the firewall. FR1109 is the feature request to support accounting directly on the firewall, but it isn't implemented yet. You'll want to either have your RADIUS server that you're authenticating against send accounting messages where you need it, or alternatively you could setup your syslog server to parse the firewall's GlobalProtect authentication events and send the accounting messages to your Defender for Identity sensor.