FortiClient to FortiGate SSL-VPN using SMS 2FA via Azure MFA - group match not supported

Hi Ken.
 
Yes, we followed the cookbook recipe, as well as referring to the Microsoft documentation for Azure MFA, etc...
 
To clarify, I was responsible for the FortiClient/FortiGate configuration, while our customer's 3rd party Microsoft support company dealt with the Azure MFA and on-premises NPS server, so I don't know all the ins and outs of how the Microsoft side of things is configured.
 
The RADIUS attributes, specifically those that send the user's AD group membership, are part of the Network Access Policies on the NPS server.
These attributes get sent to the FortiGate with the Access-Accept, so the FortiGate then knows what AD groups the user is a member of and can match them against the firewall user groups defined on the FortiGate, and then against the firewall policies.
Obviously, the firewall user groups specify the RADIUS remote authentication server, in this case an NPS server, but more importantly the firewall user group also specifies an AD user group (rather than just "any").
 
This works fine when using Push Notification or Phone Call 2FA methods, as this part of the authentication process is not dealt with by the Fortinet components.
Once the primary and 2FA are validated, the NPS server sends the Access-Accept to the FortiGate, along with the RADIUS attributes for AD group membership.
 
SMS and App pass code 2FA methods fail when we specify AD groups in the firewall user groups, because the NPS server does not send the RADIUS attributes to the FortiGate, just the Access-Accept.
The NPS extension limitation is that it won't process any attributes in the Network Access Policies if a Challenge-Response is required and sent to the Fortinet components.
Once the user enters the SMS/App pass code in box presented by FortiClient, this gets sent back to Azure MFA and validated, then the NPS server sends the Access-Accept to the FortiGate.
However, the Fortigate receives the Access-Accept but no RADIUS attributes with AD groups to match against its firewall user groups, so the authentication fails.
 
The SMS/App pass code 2FA method DOES WORK, if the FortiGate firewall user group does not specify an AD group, just "any".
However, using "any" means we can't then differentiate the users by group and so give them different network access.
 
Ultimately I'm trying to work out if there is a way around this without introducing massive admin overhead and/or extra cost, or if I need to go back to our customer and advise they can't use those 2FA methods exactly how they want.
 
Sorry for another long post!
 
Kind regards,
Phil

Hi Tomasz.
 
Firstly, I should apologise for not updating my forum post.
 
I raised a support ticket with Fortinet, who ultimately confirmed what I'd discovered through research and testing, that the limitation is with the Microsoft NPS server.
 
In the end we agreed with our customer that any user who had to use the SMS or App pass code methods, would only be allowed the minimum access granted by an "any other user" SSL VPN firewall rule.
Users requiring more access, depending on their group membership, would have to use the Push Notification or Phone Call methods, with access granted by specific SSL VPN firewall rules placed above the "any other user" rule.
 
I haven't had time to investigate other possibilities that wouldn't require the customer to incur additional costs.
 
I hope this helps you in some way.
 
Phil