Anyconnect groups with Saml authentication Azure

[Obrez]

Hey all,

I have run into a problem moving from an ASA 5525 environment to MX, specifically Anyconnect VPN.  Currently the MX is working perfectly with saml and azure, but with the ASA solution we were able to create anyconnect "apps" in azure and apply users to the groups to restrict different access.  WIth the MX, I have not found a way to do that.  We have a lot of contractors and allowing full access to our network is not something I am willing to do.  

Has anyone out there successfully done something like this?  I keep reading that SAML groups are in the works but I see no evidence that its coming anytime soon.

cheers!

-Josh

[alemabrahao]

The Anyconnect has some limitations on MX but I think that you can achieve it using Group policies.

https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance#Group_Policies

[KarstenI]

I assume that the MX is not capable of this. Group-Policies can be applied, but I am only aware of doing this with RADIUS. And other that with the ASA, the is no secondary authorisation on the MX that can apply authorization after the SAML authentication.

[Obrez]

Update here:

Thanks for the suggestions.  After much frustration and troubleshooting I have solved the problem by using radius and the azure MFA connector for NPS found here https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension.  I am using filter-ID in NPS to push group policy firewall rules for our contractors and other groups that need VPN access, and it seems to be working great so far.