Secure Client VPN Always-On – Allow Hosts for SAML Authentication

[cheng.cathy]

We’re using Azure SAML authentication with Cisco Secure Client, and are planning to enable Always-On VPN. Since the VPN client must reach Azure SAML endpoints to complete Single Sign-On, we need to add the relevant URLs to the Always-On allow host list.

So far, I’ve added login.microsoftonline.com and login.microsoft.com, but authentication is still failing. Has anyone successfully configured this? If so, could you please share the complete list of allow hosts you’re using?  Thanks

[balaji.bandi]

i have allowed below URL and works :

*.microsoftonline.com
*.windows.net
*.msappproxy.net

you can find more information :

https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/migrate-adfs-saml-based-sso

[cheng.cathy]

Thanks Balaji, i have add these domains but still get "failed to connect to single sso url"

below is the script for the VPN connect always on, is there anything missing? 

<AutomaticVPNPolicy>true

<TrustedDNSDomains>XXXXXXX</TrustedDNSDomains>

<TrustedNetworkPolicy>DoNothing</TrustedNetworkPolicy>

<UntrustedNetworkPolicy>Connect</UntrustedNetworkPolicy>

<BypassConnectUponSessionTimeout>false</BypassConnectUponSessionTimeout>

<AlwaysOn>true

<ConnectFailurePolicy>Closed

<AllowCaptivePortalRemediation>false

<CaptivePortalRemediationTimeout>5</CaptivePortalRemediationTimeout>

</AllowCaptivePortalRemediation>

<ApplyLastVPNLocalResourceRules>false</ApplyLastVPNLocalResourceRules>

</ConnectFailurePolicy>

<AllowVPNDisconnect>true</AllowVPNDisconnect>

<AllowedHosts>*.microsoftonline.com,*.windows.net,*.windows.net</AllowedHosts>

<SuppressConnectionRetries>false</SuppressConnectionRetries>

</AlwaysOn>

</AutomaticVPNPolicy>

[balaji.bandi]

high level looks ok, but are you trying directly client and SAML you have any ISE in between ?

troubleshooting and check some guide lines :

https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect410/administration/guide/b-anyconnect-admin-guide-4-10/configure_vpn.html#Cisco_Task.dita_c17ba47e-caf3-4e87-8fbe-2d212f7302b2

https://learn.microsoft.com/en-us/windows-server/remote/remote-access/tutorial-aovpn-deploy-configure-client