AnyConnect SSO to Entra (Azure AD)

[AlanAtNgāTaonga]

Hi, I'm setting up remote worker VPN on some Windows laptops that are joined to Entra (Azure AD). We're using the AnyConnect app to connect to a MX75 'VPN server'.

The SAML connection is working, but I want something more like SSO. Is that possible using the AnyConnect client app?

Users can successfully use the AnyConnect app to connect to our MX75 using their Entra (Azure AD) credentials, but they have to type in their Azure AD username and password. Is it possible to set things up so that they don't need to type in their username? That the AnyConnect app 'gets that from the system' somehow?

This topic from 2018 suggests that this isn't possible. I'm hoping that feature has been added since then. https://community.cisco.com/t5/vpn/single-sign-on-with-anyconnect/td-p/3738521

Thanks and regards

Alan

[PhilipDAth · Accepted solution]

You need to open a support case, and ask them to set "Forceauthn= False" for SAML AnyConnect.

[Adrian4]

H Philip, is that something that needs to be added to the Azure App ?

Im not sure because I dont have access to ours and the guys at look after it have told me configuring autosign is not done at the Azure end (obviously wrong because the login prompt is a windows one - pretty sure they just fobed me off to close the ticket). Because I don't know Azure, I cant contradict them.

Could you let me know exactly where this is configured so I can tell them how to do it?

Thanks! 

[jimmyt234]

This is a back-end Meraki setting that you will have no visibility of and need to ask Meraki support to set.

[Adrian4]

ah brilliant, cheers

[AlanAtNgāTaonga]

Hi Phil

That worked an absolute charm. Seems almost too good to be true! Now, if I log in to Windows with my MS365 ID, I can connect the AnyConnect VPN without any further authentication required. 

I'd up the kudos points by 100 if I could, but it'll only register one!

Thanks very much. I know where to come now if I need a Cisco consultant in New Zealand!