DOCUMENT LIBRARY

FortiGate / FortiOS

FortiManager

FortiAnalyzer

Admin Guide

Introduction
Licensing and availability
- Subscription licensing
- Free licenses
- SMS licensing
- Email notification on license balance status
Support for EU GDPR
Architecture
Acronyms and abbreviations
Quickstart guide
- Getting started—FGT-FIC users
- Getting started—FAC-FIC users
Main features
Compatibility
- Compatible Fortinet applications
- Supported browsers
Important notes
- Trial account API request limit
- The same token for the same user on multiple applications
- A single FIC user in multiple applications
- Admin accounts and realms
- Supported OTP hard tokens
- Supported FIDO security key
- No SMS MFA with FAC as LDAP server
- FAC users' name issues on FIC GUI
- How to use FortiClient
- Enabling/Disabling FIC end-users on FortiGate
- Account disablement and closure
FortiToken Mobile
- Supported FortiToken Mobile apps
- Activating FTM tokens
- Activating third-party tokens
- Using FTM tokens
Use cases
- One Token shared by different applications
- Changing separate tokens to a single token
- Independent token
- Auto-Alias features—using the same email address
- Splitting user quota among different realms
- FIC account lockout (2FA)
- Managing access to FIC
- Controlling risky conditions
- Synchronizing LDAP remote users in wildcard user group from FortiGate
- Transferring devices on FIC
- ZTNA HTTPS access proxy with FIC MFA
- Adding FIC MFA to remote access IPsec VPN
- Configuring FIC as Microsoft Entra external authentication service provider
- MFA authentication context handling
- Configuring FIC as the IdP proxy for FortiSASE
- FortiIdentity Cloud as OIDC provider
Maintenance
- Adding, syncing, and deleting users
- Adding, syncing, and deleting applications (FortiProducts)
- Service debugging
Applications
- Creating FortiProduct applications
- Transferring application (FC account lockout)
- Replacing an old FortiGate with a new one
- Applications in HA mode
- Applications for third-party usage
FortiCloud
- Logging into an OU account
- Launching FortiIdentity Cloud
FortiIdentity Cloud GUI
Dashboard
- Monitoring FIC status
- Pagination for accounts with multiple sub-admin users
Managing users
- Onboarding users
- Batch-adding users
- Enabling Auto-alias by Email
- Adding user aliases
- Auto-assigning FTKs to selected users
- Getting a new FTM token
- Hiding/showing full FortiAuthenticator username
- Viewing a user's applications
- Using a temporary token
- Editing a user
- Deleting users from FIC
Managing admin groups
- Creating a sub-admin group
- Adding users to the admin group
- Adding realms to the admin group
- Editing sub-admin group configuration
- Deleting a sub-admin group
FortiProducts
- Editing a FortiProduct
- Viewing additional information about an application
- Deleting a FortiProduct
- Assigning a FortiProduct to a realm
- Managing realms
Web Applications
- Adding a web app
- Regenerating API credentials
- Editing a web app
- Deleting a web app
- Configuring secret rotation policy
- Configuring per-SP authentication settings
Management Applications
- Creating a management application
- Regenerating management application secret
- Deleting a management application
SCIM client integration
- Features and benefits
- Supported SCIM client applications
- Use case
- Integrating FIC with SCIM clients
- Demo configurations
- Known issues and special notes
Using SSO applications
- Use Cases
- Configuring per-SP authentication settings
- OIDC Parameters
Adding user source
- Using Google social login as user source
- Support for LDAP/AD user source
Managing End-User Portal
- Configuring End-User Portal
- Configuring IdP user source
- Keeping SSO applications off End-User Portal
Configuring domain mapping
Managing device ownership
- Validating device ownership
- Transferring devices
- Transferring devices on FIC
- Managing device transfer
- Performing factory reset
Managing HA clusters
- Searching for a standalone device
- Adding devices to a cluster
- Moving devices between clusters
- Removing devices from a cluster
Using mobile tokens
Using hardware tokens
Using passkeys
Session monitor
Logs
- Usage data
- Authentication logs
- Management logs
- SMS logs
- Order logs
Using templates
- Creating a custom template
- Editing a template
- Using templates
- Deleting a template
- Alarms
  - Creating a user quota alarm
  - Creating an SMS credit balance alarm
Managing custom branding
- Creating an SSO application branding theme
- Creating an End-User Portal branding theme
- Applying custom branding theme to SSO application
- Applying custom branding theme to End-User Portal
- Deleting a branding scheme configuration
Managing global settings
- Multi-Realm Mode
- Share-Quota Mode
- Account Disable/Delete Notification
- Auto-Create Application
- Username Case & Accent Sensitive
Managing realm settings
- General settings
  - Enabling Auto-alias by Email
- Authentication scheme
- FTM MFA settings
- Email MFA settings
- SMS MFA settings
- Managing password policy
- Managing user verification
Alarm routing
- Configuring receiver groups
- Configuring receivers
Adaptive authentication
- Viewing adaptive authentication policies
- Creating an adaptive authentication policy
  - Creating a Bypass MFA policy
  - Creating an impossible-to-travel policy
- Editing an adaptive auth policy
- Deleting an adaptive auth policy
- Viewing adaptive auth profiles
- Creating an adaptive authentication profile
- Applying adaptive authentication profiles
- Editing an adaptive auth profile
- Deleting an adaptive authentication profile
Managing certificates
FortiOS CLI commands for FortiIdentity Cloud
- Global system configuration
- Accessing FIC management commands
- Configuring admin users
- Configuring local users
- Configuring local LDAP users for FIC service
- Configuring wildcard LDAP users for FIC service
- Configuring local RADIUS users for FIC service
- Diagnosing FortiIdentity Cloud
- Showing user ldap
Licenses
- Licenses
- Purchasing licenses with FortiPoints
Product documentation
FAQs
Release history
Technical support
Change log

Home 26.1.0 Admin Guide

Resource rules

For a licensed account, when the total purchased user quota is x among the licenses, the related resource quota is calculated as follows:

Resource	Quota
Users	x
Realms	If x ≤ 500, then x; if x > 500, then 500 + x/10
Applications (Web, Management, SCIM, SSO, and End User Portal) combined	Maximum (x/10, 5)
User Sources	Maximum (x/10, 5)
Certificates	Maximum (x/10, 5)
Branding	Maximum (x/10, 5)
Domains	Maximum (x/10, 5)
User Groups	Maximum (x/10, 5)
Profil	100
Policies	200

x/10 will truncate any decimal places if the result is not an integer. For example, if x = 49, x/10 is counted as 4.
For realms, if the total purchased user quota is x and x is equal to or less than 500, the maximum number of realms allowed is also x; if the total purchased user quota is greater than 500, the maximum number of realms allowed is 500 + x/10. For example, if user quota is 400, the maximum number of realms allowed is 400; if user quota is 600, the maximum number of realms allowed is 560.
For maximum (x/10, 5), if the total purchased user quota is x, the maximum number of the target resource is the greater value between x/10 and 5. For example, if user quota is 40, the maximum number of the target resource is 5; if user quota is 60, the maximum number of the target resource is 6.

Resource rules

For a licensed account, when the total purchased user quota is x among the licenses, the related resource quota is calculated as follows:

Resource	Quota
Users	x
Realms	If x ≤ 500, then x; if x > 500, then 500 + x/10
Applications (Web, Management, SCIM, SSO, and End User Portal) combined	Maximum (x/10, 5)
User Sources	Maximum (x/10, 5)
Certificates	Maximum (x/10, 5)
Branding	Maximum (x/10, 5)
Domains	Maximum (x/10, 5)
User Groups	Maximum (x/10, 5)
Profil	100
Policies	200

x/10 will truncate any decimal places if the result is not an integer. For example, if x = 49, x/10 is counted as 4.
For realms, if the total purchased user quota is x and x is equal to or less than 500, the maximum number of realms allowed is also x; if the total purchased user quota is greater than 500, the maximum number of realms allowed is 500 + x/10. For example, if user quota is 400, the maximum number of realms allowed is 400; if user quota is 600, the maximum number of realms allowed is 560.
For maximum (x/10, 5), if the total purchased user quota is x, the maximum number of the target resource is the greater value between x/10 and 5. For example, if user quota is 40, the maximum number of the target resource is 5; if user quota is 60, the maximum number of the target resource is 6.

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

Web Application / API Protection

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

All Products

Admin Guide

Resource rules

Resource rules

Resource rules

Resource rules