WatchGuard Account SSO Integration with Microsoft Entra ID

This document describes how to set up multi-factor authentication (MFA) for your WatchGuard accounts with Microsoft Entra ID as an identity provider.

Contents

WatchGuard Account Authentication Data Flow with Microsoft Entra ID

Microsoft Entra ID communicates with various cloud-based services and service providers with the SAML protocol. This diagram shows the data flow of an MFA transaction for WatchGuard Cloud.

The screenshot of workflow topoligy

Before You Begin

Before you begin these procedures, make sure that:

  • You have a Microsoft Azure global administrator account within the Microsoft Entra ID tenant.
  • You have a tier-1 WatchGuard Cloud account, and an operator with the Owner or Administrator role.

Additional charges might apply to use Microsoft Entra ID.

Configure Microsoft Entra ID

Before you configure Microsoft Entra ID, you must save the WatchGuard Service Provider SAML metadata file.

To save the WatchGuard Service Provider SAML metadata file:

  1. Log in to WatchGuard Cloud with your WatchGuard user account credentials.
  2. Select Administration > SSO.
    The SAML SSO page opens.

Screenshot of WGID, WGC-Administrator-SSO

  1. Click Configure SAML SSO.
    The Important dialog box opens.

Screenshot of WGID, important pop-up

  1. Click Continue.
    The WatchGuard Account SSO Configuration Wizard page opens.

Screenshot of WGID, SP SAML metadata url

  1. From the WatchGuard Service Provider SAML Metadata text box, copy the WatchGuard Service Provider SAML Metadata URL.
  2. On a new tab on your web browser, enter the WatchGuard Service Provider SAML Metadata URL you copied in the previous step.
  3. To save the WatchGuard Service Provider SAML metadata file to your system, right-click on the page, then select Save As.

To complete the configuration, keep the WatchGuard Account SSO Configuration Wizard page open. After you configure the Microsoft Entra ID, you must configure the settings on this page.

To configure Microsoft Entra ID:

  1. Log in to the Entra ID portal with your Microsoft Azure account credentials.
  2. Search for and select Microsoft Entra ID.
  3. To add a Microsoft Entra ID user, select Manage > Users > All users > + New User.
  4. Select Create New User. Make sure your user email address matches the UPN value of the user.
    The Create New User page opens.

Screenshot of Microsoft Entra ID, create new user

  1. Click Create.
  2. On the Microsoft Entra ID page, select Manage > Enterprise Applications.
  3. Select Manage > All Applications > New Application.
  4. Click Create Your Own Application.
    The Create Your Own Application page opens.

Screenshot of Microsoft Entra ID, create your aplication

  1. In the What's the Name of Your App? text box, type a name.
  2. Select Integrate Any Other Application You Don't Find in the Gallery (Non-Gallery).
  3. Click Create.
  4. Select Manage > Single Sign-On.
    The Single Sign-On page opens.

Screenshot of Microsoft Entra ID, select SAML as the SSO method.

  1. From the Select a Single Sign-On Method section, select SAML.
    The SAML-Based Sign-On page opens.
  2. Click Upload Metadata File.
    The Upload Metadata File dialog box opens.

Screenshot of Microsoft Entra ID, upload metadata file

  1. Browse and select the WatchGuard Service Provider SAML metadata file you saved in the previous section.
  2. Click Add.
  3. Click Save.
  4. To close the Basic SAML Configuration page, click The screenshot of close icon.
    The Test Single Sign-On With <your application> dialog box opens.
  5. Click No, I'll Test Later.
    The Set Up Single Sign-on with SAML page opens.

Screenshot of Microsoft Entra ID, download federation metadata url

  1. From the SAML Certificates section, next to Federation Metadata XML, click Download.
  2. From the navigation menu, select Manage > Users and Groups.
    The Users and Groups page opens.

Screenshot of Microsoft Entra ID, assign users/groups to your application

  1. Click + Add User/Group.
  2. Click None Selected, then select the user you created.
  3. Click Select.
  4. Click Assign.
  5. To enable the Microsoft Entra ID multi-factor authentication, from the navigation menu, select Security > Conditional Access.
  6. Select + New Policy.
    The New Conditional Access page opens.

Screenshot of Microsoft Entra ID, include user

  1. In the Name text box, type a policy name.
  2. From the Assignments section, for Users or Workload Identities, click 0 Users or Workload Identities Selected.
  3. From the What does this policy apply to? drop-down list, select Users and Groups.
    The options to include or exclude the users and groups show.
  4. From the Include tab, select Select Users and Groups.
  5. Select the Users and Groups check box.
  6. From the Select section, click 0 Users and Groups Selected.
  7. Search and select the user or group, then click Select.
  8. Under the Access Controls section, for Grant, click 0 Controls Selected.
    The options panel to block or grant access opens.

Screenshot of Microsoft Entra ID, grant access

  1. Select Grant Access.
  2. Select the Require Multifactor Authentication check box.
  3. For For Multiple Controls, select Require All the Selected Controls.
  4. Click Select.
  5. For Enable Policy, select On.
  6. Keep the default values for other settings.
  7. Click Create.

Configure SSO for Your WatchGuard Account

To configure SSO for your WatchGuard account:

  1. From the WatchGuard Account SSO Configuration Wizard page you open in Configure Microsoft Entra ID, click Select a Metadata File.
  2. Upload the Microsoft Entra ID metadata file you downloaded in this section.

Screenshot of WGC, upload metadata file

  1. Click Next.
    The SAML Configuration options open.

Screenshot of WGC, SAML Configuration page

  1. In the IDP Name text box, type a name to identify your identity provider. In our example, we name the IDP microsoft_entra_id.
  2. Keep the default values for other settings.
  3. To open the SSO Reference URLs page, click Next three times.
    The SSO Reference URLs page opens.

    The SSO reference URLs provide you with the direct links to the SSO login page for each account.

Screenshot of WGC, SSO Reference URLs

  1. Click Save.
  2. From the top of the page, click Back to WatchGuard Cloud.
  3. Select The screenshot of user icon > My Account.
  4. Select SSO. Make sure the Enable SAML SSO toggle status is green.
  5. To add the operators in WatchGuard Cloud, follow the steps in Add Operators to Your Account.

    6. To log in with SSO, you must have a WatchGuard Cloud operator account and an Azure user account. Both user accounts must have the same email address. After you add the operator, make sure the Enable Login With SAML SSO check box is selected.

Screenshot of WGC, add operators

When you configure SAML SSO for your WatchGuard account, users can either log in with SSO or with their local user account. We recommend users log in with SSO so they do not have to re-authenticate after their initial login.

Test the Integration

To test Microsoft Entra MFA with your WatchGuard Account, you can choose any method (Microsoft Authenticator number matching, Microsoft Authenticator code, SMS code, or Phone call).

Microsoft Authenticator number matching is enabled for all authenticator push notifications. In this example, we show the Microsoft Authenticator number matching method.

  1. In a web browser, go to WatchGuard Cloud.
  2. Click Log In With SSO.
  3. In the IDP Name text box, type the IDP name.

Screenshot of WGC, test sso

  1. Click Log In.
  2. In the Sign In text box, type your email.
  3. Click Next.
  4. In the Enter Password text box, type your password.
  5. Click Sign In.
    The Approve sign in request page opens.
  6. To complete the approval. enter the number you see in your authenticator app.
  7. Click Yes.
    You are logged in to WatchGuard Cloud.