Using Access Role of AzureAD

[Robin_Greve]

Goal:

VPN user login with MFA while respecting all groups the user belongs to.

Scenario:

During VPN login, the user at AzureAD is only checked against the one group that is allowed to perform VPN.
This means that only this one group can be used in the set of access rules.

We are using SAML Support for Remote Access VPN (Remote Access VPN R81.10 Administration Guide) and this is working as expected. The Firewall Management and Gateways are running on GAiA R81.10 and are on premise. If the vpn user logs in, when he/she only belongs to one Source User Group which is configured in the AzureAD (EXT_ID....).

Question:

Is there any way how the firewall can check which user groups (AzureAD) the vpn user also belongs to? This is to allow specific access regarding all groups the user belongs to.

@Shay_Levin 

[PhoneBoy]

By default, all groups the user is a member of are passed in the SAML assertion once the user authenticates.
The only groups that will be used, however, are ones that are explicitly defined on the Check Point side (i.e. with the name EXT_ID_xxx).