We have Entra ID with Global protect works well with SSO but security wants additional MFA

[din100]

We already have the SSO setup with MFA. but security wants us to have a additional MFA.

Is their a way to do this ? 

[JayGolf]

Hi @din100 ,

Do you have 2FA setup for your SSO? Or do users just auth via username/pass creds. On the Azure side, Conditional Access is where you can setup 2FA with DUO/authenticator/RSA

[din100]

yes we have a 2fa with SSO but security wants users to MFA in every time they connect to the VPN. because it's SSO they connect automatically which they think It's not secure 🤕

[TomYoung · Accepted solution]

Hi @din100 ,

This may be an issue with your Azure cookie settings.  Check these posts.

https://live.paloaltonetworks.com/t5/globalprotect-discussions/globalprotect-azure-saml-mfa-prompt-e...

https://live.paloaltonetworks.com/t5/globalprotect-discussions/force-user-credentials-at-every-login...

Thanks,

Tom

[din100]

Thank you sorry my search didn't come up with that result 

[vte888]

Your security staff or whomever is in control of your VPN configuration, need to test and learn how to get the 2FA/MFA to work properly and turn off the SSO if they feel that is not secure.  And then they need to have the patience of saints teaching their users how to install some Authenticator App on a phone so that you all can experience the LOVELY MFA that my company has me going thru... every 24 hours... I have to show my face to my phone... in between it remembers I did it already that day.  The stuff works.  But it probably is easy to mess up the configuration of it.