Want to use on-prem AD server to authenticate users on VM Series in Azure

[FCalderone]

I have a VM series firewall deployed in Azure with a VPN connection to my on-prem PA firewall.  I have GP working on the VM firewall via local user database but I am unable to get the VM firewall to utilize my on-prem AD server to authenticate users.  I have tried adjusting the service route but this does not work for dynamic-DHCP interfaces.  How do I go about accomplishing this?

[OtakarKlier]

Hello,

Where is the traffic failing? Check the traffic logs to see. Might need to make additional policies to allow it.

Regards,

[benslade]

I've been working on a similar problem and as we're in a hybrid Azure/O365 state, we've had to implement more infrastructure than simply authenticating AD users! To cut a  long story short we've go this working using SAML authentication from our AzureAD and have a hybrid connector to sync on-prem AD with AAD

If you've got GP on your VM working then it's pretty straight forward to configure SAML for SSO, following this article worked for us;

https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/palo-alto-networks-globalprotect-t...

good luck