Configure SAML settings on FortiAuthenticator

To configure FortiAuthenticator IdP settings:

1. Go to Authentication > SAML IdP > General and click Enable SAML Identity Provider portal.
2. Configure the following settings:
   1. Server address: The IP address or FQDN of the FortiAuthenticator.
   2. Realms: Select the previously created SAML realm.
   3. Default IdP certificate: Choose a certificate. The default can be used if desired.
      The remaining settings can be left in their default state.
      
3. Click OK to save your changes.
   

To configure the O365 service provider settings on FortiAuthenticator:

1. Go to Authentication > SAML IdP > Service Providers and click Create New.
2. Configure the following settings:
   1. SP name: enter a name for your O365 service provider.
   2. IdP Prefix: Click Generate prefix to create a new IdP prefix.
   3. Server certificate: Select the certificate to be used in your configuration or choose Use default setting in SAML IdP General page.
   4. IdP signing algorithm: Select Use default signing algorithm in SAML IdP General page.
   5. Participate in single logout: Can be enabled if you wish this SP to participate in SAML single logout.
3. In the Assertion Attribute Configuration section, configure the following settings:
   1. Subject NameID: Select Subject NameID.
   2. Format: Select urn:oasis:names:tc:SAML:2.0:nameid-format:persistent.
      
4. Click Save and the SP Metadata and Assertion Attribute fields are displayed. Configure the following settings for the SP Metadata.
   1. SP entity ID: Enter urn:federation:MicrosoftOnline.
   2. SP ACS (login) URL: Enter https://login.microsoftonline.com/login.srf.
   3. SP SLS (logout) URL: Enter https://login.microsoftonline.com/login.srf.
5. In Assertion Attributes click Create New and configure the following assertion attribute:
   1. SAML attribute: IDPEmail
   2. User attribute: SAML assertion
   3. Custom field: IDPEmail
6. Save your changes to the SAML SP.