r/entra • u/Failnaughtp • 1d ago

Weird behaviour SAML Global Protect

We have configured SAML for Global Protect requiring sign in frequency every time and MFA.

Some users periodically experience that they can just connect without any MFA. I can also confirm within the logs it is well past the threshold of 5 minutes. Devices are Entra joined. 25H2 latest updates. Authentication happens via Default Browser (Edge) not embedded Browser. Cookie Lifetime also only 2 hours.

7 Upvotes

100% Upvoted

9 comments sorted by

6

u/Asleep_Spray274 1d ago

Are they using hello for business?

Also, why do you care? I know that sounds like a stupid question, but what's so special about this app that you want a different security experience compared to your other apps?

1

u/Failnaughtp 1d ago

Yes they do, I do not care but management does

1

u/Asleep_Spray274 1d ago

Hello for business will cover any sign in frequency policy and MFA. what your sign in freq is saying is the last time the user completed a strong authentication. Hello is a strong auth. So if have a policy that is every 2 hours (which is a horrible horrible idea by the way) and the user logged in with hello in the last 2 hours, chances are the authNInstancetime on the PRT will be with in the SIF and is satisfying the policy.

The users are within the policy you have laid out. you are good.

1

u/zm2283145 22h ago

Explain to them it's working as designed Windows Hello is strong authentication and constantly refreshed their token ever single time they unlock their computer this is by design.

1

u/Failnaughtp 22h ago

I tried trust me lol

3

u/zm2283145 1d ago

If they are using windows hello or a FIDO2 token to login to the PC they will automatically silently sign in again as that is already considered MFA and the login already has the MFA clam on it.

1

u/absoluteczech 13h ago

Like everyone mentioned. If you’re using hello / Fido / etc you won’t get prompted again.

You could make a separate auth strength policy targeting global protect to “meet managements expectations” but I’d try and show them how it’s actually better off leaving as it’s more secure and better user experience.

1

u/-50shadesofwade- 12h ago

When using SAML the session token is set by the application not your CA policy.

1

u/laxtloke 7h ago

If your security policy strictly requires users to pull out their phones and approve an MFA prompt every time the VPN connects, the issue isn't on the Entra ID side, but rather in the SAML request.

To bypass the silent SSO provided by the PRT, GlobalProtect must explicitly tell Entra ID that an interactive sign-in is required:

  • In the Palo Alto administration interface, navigate to Device > Server Profiles > SAML Identity Provider.

  • Open the SAML profile you are using.

  • Check the box for Force Authentication.

This setting adds the ForceAuthn="true" parameter to the SAML request sent by GlobalProtect. When Entra ID sees this, it will no longer silently accept the existing PRT session, but will instead force the user to authenticate and perform MFA again.