Cisco Meraki MX integration into Microsoft Defender for Identity

[MerakiQuestions]

Hi Community,

We currently use Meraki MX67/MX68 devices across our global office locations and are looking at using vMX on Azure. We have setup SAML AzureAD auth for Cisco Secure Client SSO/MFA, which works very well.

We are licensed to use Microsoft Defender for Identity and would like to ingest Client VPN accounting data from all MX devices into Microsoft Defender for Identity: having reviewed the Microsoft documentation, it seems the supported ingestion method is via Radius Accounting. Is it correct that the MXs don't currently support radius accounting for Client VPN?

Has anyone achieved this integration without reverting to full Cisco SecureClient client auth through a radius server instead of directly with Azure via SAML?

Any recommendations on set would be appreciated. 

Thank you in advanced for your feedback. 

[Mloraditch]

Correct client VPN does not support accounting. Based on Microsoft's documentation MXs are not a supported platform the the VPN integration: https://learn.microsoft.com/en-us/defender-for-identity/vpn-integration

Even if you changed to a radius server, accounting data would not be generated. You would need a different VPN solution if you must have accounting data. Cisco's ASA's are supported.