DOCUMENT LIBRARY

FortiGate / FortiOS

FortiManager

FortiAnalyzer

Examples

Introduction
FortiToken and FortiToken Mobile
- 2FA with FortiToken Mobile
RADIUS authentication
- 2FA on FortiPAM for RADIUS users using FortiAuthenticator
SAML authentication
- 2FA on FortiPAM for SAML users using FortiAuthenticator
JWT
- JWT (JSON Web Token) integration with DevOps
ZTNA
- ZTNA endpoint control on FortiPAM
Secret configurations
- Accessing a Linux server using PuTTY
  - Creating a secret with Unix template
  - Launching a secret for the Linux server
- Accessing a Cisco router using PuTTY
  - Creating an associated secret
  - Creating a secret with Cisco User (SSH Secret) template
  - Launching a secret for the Cisco router
- Accessing a FortiGate using PuTTY, Web SSH, or the Web launcher
  - Creating a secret with Unix template
  - Launching a secret for the FortiGate
- Accessing a Windows server using the Remote Desktop- Windows launcher
  - Creating a secret with Windows Machine template
  - Launching a secret for the Windows server
- Visiting a web application/platform using web launchers
  - Installing Fortinet Privileged Access Agent web extension on Chrome/Edge
  - Creating a secret for general web application/platform
  - Creating a secret for AWS root/IAM account
  - Visiting web application/platform using web launcher
  - Reviewing video recording for the web launching session
  - Reviewing secret log for the web launching session
- Accessing a generic machine using Web VNC, VNC Viewer, or the TightVNC launcher
  - Creating a secret with Machine template
  - Launching a secret for the machine
- Accessing a target server using locally installed WinSCP client
  - Installing WinSCP on a local machine
  - Creating a secret with Unix Account (SSH Password) template
  - Launching a secret for the target server using the WinSCP launcher
- Accessing an SFTP server using the Web SFTP secret launcher
  - Creating a secret with Unix Account (SSH Password) template
  - Launching a secret for the SFTP server using the Web SFTP launcher
- Accessing an SMB server using Web SMB launcher
  - Creating a secret with Windows Domain Account (Samba) template
  - Verifying the password
  - Launching a secret for the SMB server using the Web SMB launcher
- Checking out and checking in a secret
  - Creating a secret with check out enabled
  - Checking out a secret
  - Checking in a secret
- Using a secret requiring approval
  - Creating an approval profile
  - Creating a secret with mandatory approval requirement
  - Sending a request to access a secret
  - Approving a secret request
  - Launching a secret that requires approval
- Running a script on a target server using jobs
  - Creating a job approval profile
  - Creating a secret with mandatory approval requirement for launching a job
  - Creating an ssh script type job
  - Sending a request to access the job
  - Approving a job request
  - Results
- Configuring a secret that supports TOTP
  - Configuring a secret template with TOTP
  - Creating a secret with TOTP enabled
- Accessing a MySQL server using MySQL CLI launcher
  - Creating a secret using the database server template
  - Launching a secret for the MySQL server
- Configuring integrity check for the PuTTY launcher
  - Creating an entry for the PuTTY launcher
  - Enabling integrity check in the launcher and secret template
  - Creating a secret with integrity check
  - Launching the secret
- Block uploading a JavaScript file via the Web SFTP launcher
  - Configuring the DLP file pattern
  - Configuring a DLP sensor profile
  - Creating a secret with a DLP sensor profile
  - Results
- Block transferring .exe files and log file downloads of size larger than 500KB
  - Configuring the DLP file pattern
  - Configuring a DLP sensor profile
  - Creating a secret with a DLP sensor profile
  - Results
- Updating a service account credential
  - Updating a service account credential
- Creating a secret with the Certificate Vault template
  - Creating a certificate secret
  - Setting up email alert for certificate expiry
- Configuring a secret using the Target Only secret template
  - Example 1: Creating a secret using the Target Only template
  - Example 1: Launching the secret
  - Example 2: Creating a secret using the Target Only template
  - Example 2: Launching the secret
- Smart association for Windows AD server as the target
  - Creating a secret with Windows Domain Account as the secret template
  - Creating a remote user
  - Results
- Access multiple Windows servers on the same domain
  - Creating targets
  - Creating a secret for the domain user
  - Creating a secret for the Windows PC- 10.59.112.201 and Windows PC- 10.59.112.208
  - Sharing secrets to a contractor
  - Result
- Azure AD password changer
  - Configuring the Azure portal
  - Configuring FortiPAM
  - Results
  - Troubleshooting
Audit
- Sponsored administrator audits secret activities
Web proxy
- Configuring the web proxy feature to prevent web credentials from leaking
RDP log retrieval
- RDP log retrieving on FortiPAM
Gateway
- FortiPAM connects to a target through a FortiProxy acting as the gateway
- Configuring FortiPAM/FortiGate as the reverse gateway
- Configuring FortiGate forwarding access request from FortiPAM to the private target
- Accessing a private target using secret gateway chaining
SSH filter profiles
- Configuring an SSH filter profile on FortiPAM to restrict SSH access to secret servers
  - Configuring SSH filter profiles in the CLI
  - Configuring SSH filter profiles using the GUI
Automation
- Using default automation stitch- Secret Credential View
  - Using the Secret Credential View automation stitch
  - Results
- Customizing an automation stitch
Windows application filter
- Creating a Windows application filter to prevent running executables
- Creating a non-Windows application filter to prevent running executables
  - Creating a target with server information as non-Windows
  - Creating a non-privilged secret
Web launcher
- Using web launcher to auto fill credentials on a website
Log and video disks
- Back up and restore your log and video files
Certificate management
- Configuring certificate using the ACME protocol to access a FortiPAM instance
  - Creating a certificate
  - Configuring the FortiPAM SSL certificate
- How to deploy FortiPAM CA to Windows host using EMS and FortiClient
Logging servers
- FortiAnalyzer Cloud as a logging server
FortiGate
- FortiPAM behind FortiGate
Change Log

Home FortiPAM 1.9.0 Examples

1.9.0

Azure AD password changer

FortiPAM supports changing and verifying user credentials stored in Azure AD by integrating with a Microsoft Entra (Azure AD) Enterprise application and an application client secret.

This example walks you through the required configuration on Azure and on FortiPAM so that password verification and rotation work end‑to‑end.

Requirements

An Azure tenant where you can register an application, configure Certificates & secrets, and grant API permissions (admin consent).
FortiAuthenticator with access to create secrets using the Azure Credential and Azure AD Account templates.

To configure an Azure AD password changer:

Azure AD password changer

FortiPAM supports changing and verifying user credentials stored in Azure AD by integrating with a Microsoft Entra (Azure AD) Enterprise application and an application client secret.

This example walks you through the required configuration on Azure and on FortiPAM so that password verification and rotation work end‑to‑end.

Requirements

An Azure tenant where you can register an application, configure Certificates & secrets, and grant API permissions (admin consent).
FortiAuthenticator with access to create secrets using the Azure Credential and Azure AD Account templates.

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

Web Application / API Protection

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

All Products

Examples

Azure AD password changer

Azure AD password changer

Requirements

To configure an Azure AD password changer:

Azure AD password changer

Azure AD password changer

Requirements

To configure an Azure AD password changer: