External IdP

FortiCloud supports using an external identity provider with SAML 2.0 and IdP initiated authentication. Once the setup is complete, external users can authenticate with the desired provider and access FortiCloud services based on the roles defined by the administrator.

FortiCloud supports fine grained permission profile for external IdP users through external IdP IAM role. External IdP roles allow external users to log in to a cloud portal using their organization’s ID provider. External IdP roles are authenticated with a custom login page. After the user is authenticated, they are redirected to a page where they can select the cloud portals assigned to their account.

Once external IdP has been configured for the account, you can proceed with creating external IdP roles. External IdP roles can then access the account and the various FortiCloud Services portals. See Selecting IdP roles for more information on accessing the portal with an external IdP role.

This document only covers configuring external IdP with Okta and Microsoft Entra ID. However, multiple external identity providers are supported by FortiCloud.

This section includes:

• Enrolling for external IdP

• Configuring external IdP

• Adding external IdP roles to the application

• Setting a co-exist end date

• Troubleshooting external IdP