Adding an Entra ID server

You can integrate Microsoft Entra ID with on-premise EMS and FortiClient Cloud.

FortiClient (macOS) does not support Entra ID integration with EMS.

To create an enterprise application for FortiClient:

1. In the Azure portal, go to Microsoft Entra ID > Enterprise applications > New application.
2. Click Create your own application.
3. In the What's the name of your app? field, enter the desired name.
4. Under What are you looking to do with your application?, select Register an application to integrate with Azure AD (App you're developing).
5. Click Create.

To add Microsoft Graph API application permissions required for searching user groups:

1. In the left menu, click App registrations, then click the All applications tab.
2. Click your FortiClient enterprise application.
3. In the left menu, click API permissions, and click Add a permission.
4. In the Request API permissions slide-in, click Microsoft Graph.
5. Select Application permissions.
6. In Select permissions, search for and select the following permissions:
   • Device.Read.All
   • Domain.Read.All
   • Group.Read.All
   • GroupMember.Read.All
   • User.Read
   • User.Read.All
7. Click Add permissions.
8. In API permissions, click Grant admin consent for Default Directory. If Azure grays out this option, you must log into an Azure admin account to perform this step.

To add a client secret string and determine its value:

1. In the left menu, click App registrations, then click All applications.
2. Click your FortiClient enterprise application.
3. In the left menu, click Certificates & secrets and click New client secret.
4. In the Add a Client Secret slide-in, add a Description and select the desired Expires option. Click Add.
5. Observe that a new client secret has been created. Immediately after creation, copy the Value of the client secret string, which EMS uses as the Azure Client Secret. This value is not visible after this initial creation step and moving to another page.

To configure an Entra ID server in EMS:

1. Configure the Entra ID server as an authentication server in EMS:
   1. In the Azure management console, collect your tenant ID, client ID, and client secret.
   2. Go to Administration > Authentication Servers.
   3. Click Add > Azure.
   4. In the Tenant ID and Client ID fields, enter the IDs that you collected from the Azure management console.
   5. For Authorization Type, select Client Secret.
   6. In the Client Secret field, enter the client secret that you collected from the Azure management console.
   7. Configure other fields as desired.
   8. Click Test.

      

   9. After the test succeeds, click Save.
2. Go to Endpoints > Manage Domains.
3. Click Add, then Azure.
4. From the Azure Server dropdown list, select the desired server.
5. In the Sync every field, enter the number of minutes after which EMS syncs with the Azure server.
6. For Group Selection Behaviour, select Import Entire Azure Domain or Import Selected Azure Groups.
7. Enable Import as Base Group for the desired groups, then click Save.

   

   Endpoints > Domains lists the Entra ID server domain groups and subgroups. It lists subgroups as a flat list and does not preserve the hierarchy from the AD server.

When using user management, Entra ID users can register their FortiClient to EMS using an invitation code or with SAML.

To configure the Azure tenant app for initiating passthrough (domain):

This is necessary for registering an Entra ID endpoint to EMS using an invitation code. This only applies for Entra ID-joined endpoints.

1. Configure the redirect URL:
   1. In the Azure portal, go to App registration. Copy the application/client ID of the application used to connect with EMS.
   2. Click the application, then click the Redirect URIs link.
   3. Click Add a Platform > Select Mobile and Desktop applications.
   4. Add the following URL: ms-appx-web://microsoft.aad.brokerplugin/<application client ID>.
   5. Under Allow public client flows, toggle to Yes for Enable the following mobile and desktop flows.
   6. Save the configuration.
2. Go to Roles and administrators.
3. Search for and select Directory Readers.
4. Click Add assignments.
5. Select the application used to connect with EMS.
6. Add desired users to the application in Entra ID:
   1. Go to Enterprise applications, and select the application used to connect with EMS.
   2. Go to Users and groups.
   3. Click Add user/group, and select the users that you will invite to EMS using an invitation code.