Identity Awareness across multiple sites and AD domains

[StevePearson]

I'm currently exploring how to roll out Identity Awareness am am looking for any tips and advice!

I have ID awareness running on one site using ID agents on the endpoints, which works just fine. Now I have deployed 1500 series devices to other sites, all managed from the same SMS, and need to look at rolling out ID awareness on these. The remote sites are on different AD domains, so these will need to be created as objects and configured accordingly, then I should be able to share the identities between the gateways. The problem here is the inter-site communication, it is not traditional S2S VPNs, it's Harmony SASE. On top of that, domain controllers are only accessible at the sites that they serve.

So whilst the identity will work fine on the users home site using access roles linked to the local AD, when the user goes to a different site they will log into their laptop using cached credentials and I don't think the ID agent will connect as it won't see it's expected gateway. I'm not sure, but I thought there was a way to define multiple gateways for the ID agent to use, which may have been an option, but I can't find any details on this.

Has anyone else tried to do anything like this at all?

[PhoneBoy]

I would think Harmony SASE (possibly with additional configuration) would enable the Identity Agent to connect to the right gateway successfully (ie to authenticate to the end user’s home AD).
This is configured by using a specific FQDN in the Identity Agent config and relevant DNS entries.

Not sure one installation Identity Agent will support multiple gateways managed by different domains, at least without some sort of trust prompt.