A single FIC user in multiple applications

A given FIC end-user can be in two or more applications (FGT and/or FAC devices), resulting in the so-called "a-single-user-in-multiple-appications" situation. For example, User-1 can be in FGT-1 and FGT-2. An FIC admin user is able to see all applications (FGTs) for a given end-user on the FIC portal.

You must keep the following two important points in mind when handling such a situation:

(1) When you disable (remove) User-1 from FGT-1, it still exists in FGT-2. As a result, User-1 still remains in FIC. The only way to remove User-1 from FIC is to remove it from both FGT-1 and FGT-2.

(2) Suppose you have enabled User-1 for FIC in FGT-1 and FGT-2, and User-1 has a token from FIC. You disable User-1 in FGT-1, but leave it still enabled in FGT-2 so that it still exists in FIC. Later on, if you enable User-1 again without assigning a new FIC token to it, User-1 will continue to use the same FIC token that it has used before. Now suppose, instead of enabling User-1 again in FGT-1, you assign SMS from FGT-1 (an FGT internal feature that is not available in FIC) as the MFA method for User-1. This is what is going to happen: If User-1 attempts to log into FGT-1, the user will get an SMS from FGT-1; but if User-1 attempts to log into FGT-2, the user will have to use the FIC token.

FortiIdentity Cloud uses the multi-realm concept. As a result, two identical end-users can co-exist on two different applications assigned to two different realms.