Connecting Palo Alto GlobalProtect to Microsoft Entra ID with SAML lets your VPN use the same sign-in, MFA, and Conditional Access as Microsoft 365. Here is how it fits together and what to watch for.
Key Takeaways
- SAML moves VPN sign-in to Entra ID, so MFA and Conditional Access apply to GlobalProtect.
- Pair it with a client certificate if you want only managed devices to connect.
- Test device-based Conditional Access carefully, because it depends on the browser used for sign-in.
Why connect GlobalProtect to Entra ID
Many GlobalProtect setups still check passwords against local firewall accounts, LDAP, or RADIUS. That leaves VPN sign-in outside your Microsoft 365 controls. With SAML, the firewall hands sign-in to Entra ID, so users sign in the same way they do for email, with the same MFA and Conditional Access policies, and leavers lose VPN access when their account is disabled.
Remote access is also a standard question on cyber insurance applications. See does cyber insurance require MFA.
How the setup fits together
- In Entra ID, add the Palo Alto Networks GlobalProtect enterprise application, set the identifier and reply URLs to your portal and gateway, and assign the users or groups allowed to connect.
- On the firewall, import the Entra ID SAML metadata as an identity provider server profile, and create an authentication profile that uses it.
- Apply that authentication profile to the GlobalProtect portal and gateways.
- Use authentication override cookies so users aren’t asked to sign in twice for the portal and the gateway.
- Create a Conditional Access policy that targets the GlobalProtect app, starting in report-only mode.
Adding a device check
SAML proves who the user is, not which device they’re on. To keep personal devices off the VPN, require a client certificate on the portal and gateway, issued by Intune to managed devices from the same PKI you use for certificate-based Wi-Fi.
Conditional Access can also require a compliant device, but that depends on the sign-in browser passing device information to Entra ID. Recent GlobalProtect app versions can use the device’s default browser for SAML, which helps. Test with a pilot group before relying on it.
Common mistakes
- Leaving the old local or LDAP sign-in enabled as a fallback that skips MFA.
- Not assigning users in Entra ID, so anyone in the tenant can start a sign-in.
- Forgetting certificate expiry. The SAML signing certificate in Entra ID expires, and the firewall needs the new one before it does.
- Skipping report-only mode for the Conditional Access policy, then locking out remote staff.
Where we fit
We set this up as part of network and firewall management, alongside Entra ID and Conditional Access.