The config vpn ssl settings option tunnel-addr-assigned-method is now available again in the FortiGate 6000 and 7000 CLI. This option had been removed in a previous release because setting this option to first-available and configuring multiple IP pools was found to reduce FortiGate 6000 and 7000 SSL VPN load balancing performance. However, some users may want the ability to use multiple IP pools for their SSL VPN configuration, even if performance is reduced. So the change has been reverted.

The URL to verify authentication has been removed from config user saml and replaced by config user external-identity provider.

7.2.7 and earlier:

config user saml
    edit <name>
        set auth-url <string>
    next
end

7.2.8 and later:

config user external-identity-provider
    edit <name>
        set type ms-graph
        set version v1.0
    next
end

After the external identity provider is set, make sure that the existing user group has both the SAML server and the external identity provider as members:

config user group
    edit <group>
        set member <saml server> <id provider>
    next
end