topic Authentication flow using Secure Client, Entra ID and Access Manage in Cisco SASE with Meraki

Authentication flow using Secure Client, Entra ID and Access Manage

Aussietramp — Mon, 26 Jan 2026 15:42:47 GMT

Hi,

I would like to authenticate:

external suppliers
connecting via Cisco Secure Client (AnyConnect)
authenticating against Entra ID
using Access Manager as the NAC solution

In short, the idea is the following:
using the existing AnyConnect client, users connect to the vMX, and through Access Manager policies, the authentication request is forwarded to Entra ID.

Is this scenario supported and technically feasible?

Re: Authentication flow using Secure Client, Entra ID and Access Manage

aleabrahao — Mon, 26 Jan 2026 16:25:40 GMT

It cannot receive a SAML request from the MX and forward it to Entra ID. Access Manager is not designed to authenticate VPN connections Its purpose is enforcing identity-based rules for network edges (switch/AP), not VPN hubs.

Re: Authentication flow using Secure Client, Entra ID and Access Manage

Philip D'Ath — Mon, 26 Jan 2026 18:43:31 GMT

Also note that typically, you can only authenticate "member" users in your Entra ID.

You can authenticate Secure Client users directly against Entra ID (Access Manager is not required).

https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Client_VPN/AnyConnect_on_the_MX_Appliance/AnyConnect_Azure_AD_SAML_Configuration

Re: Authentication flow using Secure Client, Entra ID and Access Manage

Aussietramp — Tue, 27 Jan 2026 08:04:30 GMT

Hi Philip,

since i have few type of suppliers, can i give different group-policies? and where can i configure the group policies? cause in the MX there is only one group-policy to configure under the client-VPN-anyconnect section.

Thanks in adavance to both of you.

Re: Authentication flow using Secure Client, Entra ID and Access Manage

Philip D'Ath — Tue, 27 Jan 2026 21:01:13 GMT

I don't know if it is documented anywhere, but I explain how to apply per group policies here.

https://community.meraki.com/t5/Security-SD-WAN/AnyConnect-SAML-Group-Policy-assignment/m-p/245513/highlight/true#M54881