How to renew the Azure SAML IdP certificate on the firewall for GlobalProtect when it expires
74253
Created On 10/13/22 06:34 AM - Last Modified 01/31/26 00:23 AM
Objective
• Azure SAML IdP certificate for GlobalProtect with SAML authentication expires
• Need to renew the Azure SAML IdP certificate on the firewall
Environment
• Palo Alto Firewall
• GlobalProtect with Azure SAML authentication profile
Procedure
- Make sure to delete the old certificate on the Azure SAML IdP side
- Then export the new SAML metadata XML file (which has only the new certificate) from Azure IdP
- Import the new metadata XML file into FW through the new SAML Identity Provider profile
- After that, navigate to Device > Certificate Management > Certificates to verify and confirm the Azure SAML IdP certificate is automatically renewed on the firewall successfully.
Additional Information
NOTE : If we import new metadata XML file using the same profile as the existing one however it failed with an error
: Failed to parse IDP Metadata.
we need to make sure to import new metadata XML file with new profile.