GlobalProtect Azure/SAML MFA prompt everytime a user logs in

[asiewert]

We have setup Globalprotect to connect to EntraID using SAML. Our goal is to have the user get prompted to enter in MFA everytime they connect to the GlobalProtect portal. How can I do this? 

[TomYoung · Accepted solution]

Hi @asiewert ,

I believe the default authentication cookie lifetime in Entra is 90 days.  I think these are the steps to change it for your PANW GP application in Entra.

1. Enterprise Applications > open your GP app
2. Protection > Conditional Access
3. New Policy
4. Access controls > Session
5. Sign-in frequency > Periodic reauthentication

https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-session...

I would not set it to 0 as cookie authentication is actually used by Entra (not PANW) for the gateway.  That keeps users from being prompted for MFA by the portal and gateway.  If you want Entra to prompt them every time, 5 minutes should be good.

Thanks,

Tom

[asiewert]

I think the session sign-in frequency is key! I believe this is working for us now. Have not tested it extensively, but every time a user logs into GlobalProtect, EntraID will prompt them for multifactor now.