User-ID with Azure AD

[GOMEZZZ]

Hello,

We have PC's that are only registered inside Azure AAD and managed via Intune they have no connection to the on-prem AD and are connecting via a Wifi zone behind PA to the internet.  How can i determine the USER id, without user interaction.

Or do i need Global protect for this and SSO?

Is there someting like a User ID agent for Azure AAD.

Or maybe i can use SAML SSO with Azure AAD for captive portal, can somebody point me to a good article on how to configure this.

[Trond.Olsen]

These are good suggestions! I wasn't aware that Globalprotect could be used for autentication only though license might be an issue with iPad and Chromebook. We might get some consulant advice on Cisco ISE as we discarded it some years ago because concerns around complexity.

Concerning Azure AD we plan to remove our on-premise AD entirely.

[GOMEZZZ]

Hi,

There are different options for your problem but moving everything to the cloud will need carefull planning and decisions up front.

A good read is also:

https://docs.microsoft.com/en-us/azure/active-directory-domain-services/compare-identity-solutions

Also please have a look into Prisma if you are moving to full cloud.

[wburnett]

I think the bigger picture here needs to be put into perspective:

• Microsoft is doing everything that they can do to prevent small business from having any on-site servers or services. This includes breaking most file server functions for office, in favor of one-drive, etc. 
• Hybrid AD deployments are a disaster for SMB - Why have an AD server on-site that does nothing but remote accounts locally when inTune does as much or more than ADGP when it comes to SMB needs.
• With COVID and general WFH and BYOD fewer PCs than ever are physically connected to an AD and forcing VPN connectivity just for policy and password management updates is kind of insane when Office and everything else Microsoft is not communicating with O365.

I find it almost imperative that the LOCAL firewall policy be able apply rules based on AzureAd membership - be it User-ID or some other SSO method. I can tell you that almost every one of my SMB customers is already, or will be completely server-less by the end of the year and all will be AzureAD/Intune managed. 

There has to be a better way to put 10-50 users into policy based filtering than hydribd-AD or forcing a VPN connection from the same office that the firewall resides in. That is just insane, especially seeing that often, another VPN is used by client PCs to connect to various SaaS endpoints or hosted services. 

This is the new SMB model and Palo Alto really needs to embrace it quickly.

[trlawren]

I agree, this is something that we are planning for in the near future. Palo Alto needs to come up with a solution very quickly.

[wburnett]

Crickets...

Hello Palo Alto -- care to comment about this?

[mlopez78]

Any replies on this Palo? Plenty of people would like to see this functionality.

[Housing1]

It's July 2021 , Intune/Microsoft Endpoint Manager isn't going away.  People are moving to it.  We have moved all of out endpoints to Intune.  Palo Alto needs a solution.  Is there an update here?

[GOMEZZZ]

Hi Housing1,

As of today I am not aware of any direct integration with Azure AD.(used id agent for azure)  If you have Azure Active Directory Domain Services you could get group mappings using ldaps. 

https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/authentication/enable-group... .

To get the user info you could use a global protect client internal portal for authentication only using SAML. (portal non-tunnel model)

Or you can setup a captive portal with SAML authentication to Azure AD.

Depends on you use case.

I think the best option is to use global protect client.   For windows laptops no license is needed only for mobile endpoints and linux clients.  

[AnalysisMan]

Hello PAN team,

Were there any updates about supporting Azure AAD for User-ID since Jeff Hochberg commented in 2019?

Thanks,

[PMCHelpdesk]

Bump. Any update to this, 3 years now, this is a major problem now?