different vpn access

[Webnoob]

I have a 1570 with remote access enabled. I also have Radius configured and use NPS Azure MFA extension.
Is it possible to give the VPN users different VPN access? 

Ex. one group can RDP to one server, another group RDP to another server and a third group ssh to a specific device?

[PhoneBoy]

This should be possible (at least on most recent firmware versions) by creating Inbound VPN rules in terms of users/groups.

[Webnoob]

I have just upgraded to R81.10.17
Is there a step by step explanation?

[PhoneBoy]

There are two ways to retrieve groups:

• Via LDAP, which must be explicitly configured on each gateway to the relevant Active Directory server
• Via the SAML Assertion used as part of SAML Authentication

As far as I know, with Azure, there IS no LDAP interface.
Which means you should be using SAML here.

Are you managing this device entirely through the WebUI or are you using external management?

[Webnoob]

Users are in an onprem AD
I use Radius to get user info when they use VPN.
The device is only managed locally through the webui.

[G_W_Albrecht]

That is the most easy way to implement - Use the AD for the groups needed.

- Enable User Awareness Blade and configure AD query:

Working with User Awareness

- add manual Incoming Rules for specified user groups and service/destination, followed by a Block all rule for all groups.

Afaik SAML Authentication is only supported on Managed SMBs - and DC is much easier...