We have Entra ID with Global protect works well with SSO but security wants additional MFA

[din100]

We already have the SSO setup with MFA. but security wants us to have a additional MFA.

Is their a way to do this ? 

[JayGolf]

Hi @din100 ,

Do you have 2FA setup for your SSO? Or do users just auth via username/pass creds. On the Azure side, Conditional Access is where you can setup 2FA with DUO/authenticator/RSA

[din100]

yes we have a 2fa with SSO but security wants users to MFA in every time they connect to the VPN. because it's SSO they connect automatically which they think It's not secure 🤕

[TomYoung · Accepted solution]

Hi @din100 ,

This may be an issue with your Azure cookie settings.  Check these posts.

https://live.paloaltonetworks.com/t5/globalprotect-discussions/globalprotect-azure-saml-mfa-prompt-e...

https://live.paloaltonetworks.com/t5/globalprotect-discussions/force-user-credentials-at-every-login...

Thanks,

Tom

[din100]

Thank you sorry my search didn't come up with that result