How to setup Azure SAML authentication for admin UI

• Palo Alto Firewalls and Panorama
• Supported PAN-OS version
• Admin UI authentication using Azure SAML

Steps to be performed on the Azure portal:

1. Step 1: Login to Azure Portal  and navigate the Enterprise application under All services

2. Step 2. Look for the option New Application Search for Palo Alto and select Palo Alto Networks - Admin UI

3. Step 3: Click on create to add the application. Takes a few seconds to create:

4. Step 4:  After App is added successfully, Click on Single Sign-on

5. Step 5: Select the SAML Option:

6. Step 6: Edit the Basic SAML configuration by clicking the edit button

7. Step 7: Fill out Sign-on URL, Identifier (Entity ID), and Reply URL (Assertion Consumer Service URL) as follows. The IP/FQDN in this step refers to the management access IP/FQDN on the Palo Alto device on which the SAML is being setup.

• Sign-on URL:
  • https://FQDN
  • https://IP-address
• Identifier (Entity ID):
  •       https://FQDN:443/SAML20/SP
  •       https://IP-address:443/SAML20/SP
• Reply URL (Assertion Consumer Service URL):
  •       https://FQDN:443/SAML20/SP/ACS
  •       https://IP-address:443/SAML20/SP/ACS

Identifier (Entity ID)
https://10.73.32.145:443/SAML20/SP

Reply URL (Assertion Consumer Service URL)
https://10.73.32.145:443/SAML20/SP/ACS

Sign on URL
https://10.73.32.145

8. Step 8. Download the Federation Metadata XML and save it on your computer ( This will be imported into the firewall).

1. Step1: Login to the Firewall and Navigate to GUI: Device > SAML Identity Provider > Import

2. Step2: Import the Federation Metadata XML downloaded from Azure in step 8.

• Click "OK" to complete the import

• Option: Uncheck validate Identity Provider certificate. If checked, Certificate from Azure needs to be uploaded on the Firewall as well

3. Step3: Create an authentication Profile and select SAML and IDP server Profile.

4. Step4: Now to add SAML-Azure authentication for administrators log-in Go to GUI: Setup > Management > Authentication Settings

• Commit the changes and this concludes the configuration
• Now SAML should be enabled. On the login page, the option of Single Sign-On is displayed.

Creating Admin Users in Azure Portal:

1. Select the Azure Active Directory

2. Search and Select Users and add new users. Use the same user to access using SSO.

Note: If the authentication profile is applied on the device level then the SAML IDP should customize an attribute and name it as adminrole, this attribute is needed by the firewall to identify the user's role, the value of the adminrole should match one of the admin role that is configured on the firewall 

More detail about this in Step number 7 in the below guide:

Tutorial: Azure AD SSO integration with Palo Alto Networks - Admin UI - Microsoft Entra: