SAML-based SSL-VPN via Entra ID

Configure Entra ID SAML authentication for FortiGate SSL-VPN tunnel mode. Start with Microsoft's FortiGate SSO guide to create the enterprise application, then configure FortiGate below.

SSL-VPN availability

Support depends on both the FortiGate model and FortiOS release:

Model / release	SSL-VPN availability
50G series	SSL-VPN was unsupported from launch.
70G and variants	No web or tunnel mode from 7.4.8.
90G / 91G	Configurable in 7.4.7, removed in 7.4.8; also absent in 7.2.12 and 7.6.1.
40F and 60F / 61F families, including the listed FortiWiFi and Rugged variants	Web and tunnel mode removed in 7.6.0; available in 7.4.
All models	Tunnel mode removed in 7.6.3. Web mode continues as Agentless VPN on supported models.

Fortinet's model support table lists the affected variants. The 7.4.8 release notes cover the G-series restrictions.

Upgrades that remove SSL-VPN also discard its affected settings. For FortiClient access, migrate to SAML-authenticated IPsec before upgrading. The configuration below applies to models and releases retaining tunnel mode.

Creating the SAML User

Import the Entra application's signing certificate as a remote certificate (Azure-AD-SAML below). Copy its Identifier, Login URL and Logout URL into the corresponding IdP fields. Install a server certificate for vpn.example.com; FortiOS 7.0 onwards supports Let's Encrypt certificates through ACME.

The SP URLs must match Entra exactly, including the port if it is not 443. Configure the case-sensitive username and group claims in Entra to match user-name and group-name.

config user saml
 edit "AzureAD-SAML"
  set cert "le-vpn.example.com"
  set entity-id "https://vpn.example.com/remote/saml/metadata"
  set single-sign-on-url "https://vpn.example.com/remote/saml/login"
  set single-logout-url "https://vpn.example.com/remote/saml/logout"
  set idp-entity-id "<ENTRA_IDENTIFIER>"
  set idp-single-sign-on-url "<ENTRA_LOGIN_URL>"
  set idp-single-logout-url "<ENTRA_LOGOUT_URL>"
  set idp-cert "Azure-AD-SAML"
  set user-name "username"
  set group-name "group"
  set digest-method sha256
 next
end

The example selects SHA-256 explicitly. In Entra's SAML Signing Certificate settings, select Sign SAML response and assertion. FortiOS 7.4.9 requires both signatures; the same change applies to 7.2.12. See Fortinet's SAML troubleshooting guide.

Creating the User Group

Use the Entra group's Object ID, not its display name. Ensure the group is included in the SAML assertion. Separate FortiGate groups can match separate Entra groups for different access policies.

config user group
 edit "user-vpn"
  set member "AzureAD-SAML"
  config match
   edit 1
    set server-name "AzureAD-SAML"
    set group-name "<ENTRA_GROUP_OBJECT_ID>"
   next
   end
 next
end

Configure the SSL-VPN Portal

This example provides full-tunnel access and disables browser-based web mode. split-tunneling disable makes the routing choice explicit. The default no-access portal disables both access modes.

config vpn ssl web portal
 edit "no-access"
  set tunnel-mode disable
  set web-mode disable
  set limit-user-logins enable
  set forticlient-download disable
 next
 edit "full-tunnel"
  set tunnel-mode enable
  set web-mode disable
  set limit-user-logins enable
  set forticlient-download disable
  set ip-pools "sslvpn-users-192.168.2.0/24"
  set split-tunneling disable
 next
end

Create the client pool address object first, using an unused range that does not overlap internal networks. For split tunnelling, enable split-tunneling and configure the permitted routing destinations instead. See Fortinet's split-tunnel settings.

Configure policies from ssl.root to the permitted internal interfaces, matching the VPN pool and SAML user group. Full tunnelling also needs an internet egress policy, routing and NAT where applicable.

Configure the SSL-VPN Settings

The example uses ext-if, a 192.168.2.0/24 client pool and internal DNS servers at 192.168.1.2 and 192.168.1.3.

config vpn ssl settings
 set banned-cipher RSA 3DES SHA1
 set servercert "le-vpn.example.com"
 set login-timeout 90
 set tunnel-ip-pools "sslvpn-users-192.168.2.0/24"
 set dns-suffix "example.com"
 set dns-server1 192.168.1.2
 set dns-server2 192.168.1.3
 set port 443
 set source-interface "ext-if"
 set source-address "Geo-US"
 set source-address6 "Geo-US-v6"
 set default-portal "no-access"
 config authentication-rule
  edit 1
   set groups "user-vpn"
   set portal "full-tunnel"
  next
 end
end

Geo-US and Geo-US-v6 restrict connection sources using geographic address objects. banned-cipher excludes RSA, 3DES and SHA-1 TLS cipher suites.

login-timeout 90 allows time for interactive authentication. Configure MFA through the Entra application's Conditional Access policies.

Troubleshooting

"Invalid HTTP Request" when attempting to login.

In the original deployment, recreating the firewall policy with the SAML group as its source resolved this error after SAML had been added to an existing policy. For other failures, inspect the SAML debug for mismatched URLs, ports, certificates, claims or group membership.

Missing group claims

Entra includes up to 150 groups in a SAML assertion, counting nested memberships. Above that limit it sends an overage indicator instead of the group list, so FortiGate group matching fails. Limit the groups emitted for the application.

Debugging the SSL VPN

Capture a failed connection with SSL-VPN and SAML debugging enabled:

diagnose debug console timestamp enable
diagnose debug application sslvpn -1
diagnose debug application samld -1
diagnose debug enable

Check the TLS handshake and SAML response for the failure. Remove user identities and authentication data before sharing the capture.

Stop debugging after capture:

diagnose debug disable
diagnose debug reset