Global Protect MFA with Microsoft Authenticator

[zeromahesh]

Hi,

I am looking for the way to integrate Global Protect MFA with Microsoft Authenticator App. Please note that I need to local user database of the firewall for the authentication and Microsoft Authenticator App for the second factor.

Please help on this.

[BPry]

@zeromahesh,

I don't think this is going to be possible with Microsoft. Since this is built out as a SAML authentication provider unlike SecurID Access, Okta, Duo, and PingID where you can use the built-in MFA vendor providers. 

[zeromahesh]

Hi BPry

Thank you for replying me.. But actually I came across few articles where I thought it is possible.. Please see one the articles below and help me on this..

https://support.nvcc.edu/news/556/multifactor-authentication-mfa-for-globalprotect-vpn-and-retiremen...

[BPry]

@zeromahesh,

The document you referenced is almost certainly relying solely on their Microsoft authentication SAML provider. As stated, your wanting to use local users as the initial factor and then using Microsoft as the secondary. 
If you were using one of the built-in MFA vendors available through the firewall what you’re attempting to do isn’t an issue. Microsoft isn’t included in that list though, meaning you have to utilize SAML authentication for this provider. While not impossible to do what your asking, it’s more of a workaround and creates a poor user experience. 

I guess what I would be asking myself in your shoes is why I’m using local users as the initial factor. What benefit is that giving you in your configuration, and why aren’t you just using the SAML provider? 

[zeromahesh]

Hi Bpry

Can I use OKTA for MFA in Global Protect?

[2000gtacoma]

Just rolled this out using azure and saml to mfa. Also disabled users from approving or denying. Instead a otp must be used. To my knowledge can't do this with a local database using microsoft authenticator.

[zeromahesh]

Thanks for your reply. You can do this with Azure Active Directory P1
license and Microsoft Authenticator. Actually I implemented it.

[GustavoBou]

Hi Zeromahesh

That's nice!!! Can You share the configuration necessary with me? Thank you.

[zeromahesh]

HI Thanks. I will share the demo in my youtube channel Firewall Life.

[GustavoBou]

Hi @zeromahesh 

Very good... I dont found this video in your channel, please send the link for me.

Thank you.

[GustavoBou]

@zeromahesh 

we are looking forward to your video, need to make this work too...thank you

[zeromahesh]

Hi,

Actually I recorded a demonstration on how to integrate Palo Alto Global Protect with Azure Active Directory with Two Factor authentication. Please check the below YouTube link.

https://youtu.be/GxRdPPsIHH8