Is it possible to use only one Azure Enterprise Application to provide SAML Admin WebUI authentication/authorization for multiple non HA paired firewalls or multiple Panoramas?

Answer

Yes.. One Azure Enterprise Application can accommodate the Azure AD authentication via SAML for multiple Firewall's/Panorama's WebUI Admin Access, even when the Firewalls/Panoramas are not in an HA pair.

Please refer to the image below.

1. Add the Firewall's/Panorama's Identifier ( Panorama or Firewall's Management IP/FQDN) to the Identifier (Entity ID) along with the other existing device's Identifiers.
2. ​​Add the Firewall's/Panorama's Reply URL (Panorama or Firewall's Management IP/FQDN) to the Reply URL (Assertion Consumer Service URL) in the Azure Enterprise Application along with the other existing device's Reply URLs