Migrating from DAG to Azure

[mike.s]

We currently use Duo Access Gateway for MFA with on-premise Active Directory for our Palo Alto GlobalProtect VPN authentication.

We want to use Azure instead of on-premise AD and continue to use Duo to protect the GlobalProtect VPN.

We are having difficulty figuring out where all of the settings go e.g. Entity ID, ACS URLs, etc.

Has anyone done this and if so do you have any pointers or config examples to share?

[raphka]

Hi mike.s

You can use Duo SSO for this without on prem AD.

Initially you will want to set up Duo SSO and use Azure as the authentication source for Duo SSO.

Duo Security

How to Use Duo Single Sign-On (SSO)

Learn how to easily add two-factor authentication (2FA) with inline self-service enrollment using Duo’s simple SSO. Read more.

Once this is complete you can then protect your Globalprotect with Duo SSO.

Duo Security

Duo Single Sign-On for Palo Alto GlobalProtect

Duo’s trusted access solution enables organizations to secure access to all work applications, for all users, from anywhere, with any device they choose.