Entra ID App for SSL-VPN with 2FA

Configure Entra ID App with OpenID Connect permissions for SSL-VPN with 2FA for the UTM

Last adaptation to the version: 14.1.2 (02.2026)

New:

2FA mit Entra ID über OpenID Connect (OIDC)

notempty

This article refers to a Beta version

-

Preliminary note

Note

This article includes descriptions of third-party software and is based on the status at the time this page was created.
Changes to the user interface on the part of the manufacturer are possible at any time and must be taken into account accordingly in the implementation.
All information without warranty.

To be able to use AD authentication with Entra I, the following information is required:

Application (client) ID
Directory (tenant) ID
Secret client key

This guide shows an example of the preparations and setting required in Microsoft Entra ID
Login at Microsoft Entra Admin Center

Create new app registration
Enter the redirect URI (Type Web) from the UTM
Either: Upload certificate
Or: Create a secret client key
If necessary, copy the client key
Add Microsoft Graph API permission
Assign delegated permissions offline_access, openid, and profile
Add Application permissions User.Read.All and Group.Read.All (for reading users and groups)
This completes the configuration in Microsoft Azure.

notempty

The Microsoft servers may take up to 30 minutes before access works

Show step-by-step instructions

hide


1.	2.	3.


Abb.1	Abb.2	Abb.3


Abbildungen

Datei:Entra OIDC 01 Neue Registrierungen-en.png

Fig.1

Menu App registrations 1
Button + New Registration 2

Datei:Entra OIDC 02 Anwendung registrieren-en.png

Fig.2

Specify a name for the application (freely selectable) 3

Redirect URI: Web 4

…oauth2_redirect 5 Redirect path from the UTM Assistant Step 4

Workaround for the UTM AD/LDAP Authentication Assistant:

Enter the required value in Step 3
Enter a dummy value for the Application ID
Go to Step 4
Copy the Redirect URI there and enter it in the Entra Admin Center
Return to Step 3
After completing all steps in the Entra Admin Center,
enter the correct Application ID

Click the Register 6 button

Datei:Entra OIDC 03 Zertifikat hochladen-en.png

Fig.3

Either:

Menu Certificates & Secrets 7

Tab Certificates 8

Select certificate 9

This can be a self-created certificate from the UTM: Menu / download public key PEM. This certificate must also be stored in the UTM assistant.

With this certificate, the authentication process of the UTM authenticates with Entra ID.

Specify description 10

Certificate with the button labeled Add 11

Datei:Entra OIDC 04 Secret Key-en.png

Fig.4

Or:

Menu Certificates & Secrets 7

Tab Secret Client Keys 12

Select button New Secret Client Key 13

Specify description 14 (freely selectable)

Specify validity period 15

Key Add 16

Datei:Entra OIDC 05 Secret Key-en.png

Fig.5

If necessary, copy the client key 17
This is required as Secret Value in the assistant in Step 2

Datei:Entra OIDC 06 API Berechtigungen-en.png

Fig.6

Submenu API Permissions 18

Button Add Permission 19

Select Microsoft Graph API 20

Datei:Entra OIDC 07 API Berechtigungen-en.png

Fig.7

Select Delegated Permissions 21

Select OpenID permissions 22
These permissions are required for the app (Application ID) in the AD/LDAP Authentication Assistant of the UTM in Step 3

offline_access
openid
profile

Select button Add Permissions 23

Datei:Entra OIDC 07b Anwendungsberechtigungen-en.png

Only if no separate app is used

For the settings in Step 2 of the assistant, additional Application permissions are required:

Select submenu API Permissions (As in Fig.6. No.18)

Button Add Permission (As in Fig.6. No.19)

Select Microsoft Graph API (As in Fig.6. No.20)

Select Application permissions 24

User.Read.All 25
Group.Read.All 26

Datei:Entra OIDC 08 API Berechtigungen overview-en.png

Fig.9

Overview of assigned permissions

The permissions Group.Read.All and User.Read.All require additional administrator approval. 27
For this, at least the Cloud Application Administrator permission is required in Entra

Datei:Entra OIDC 09 Anwendungs ID-en.png

Fig.10

Select submenu Overview 28

Copy Application ID (Client) 29
(Required in the UTM Assistant in Step 2 and Step 3 as Application ID (Client ID))

Copy Directory ID (Tenant) 30
(Required in the UTM Assistant in Step 2 as Directory ID (Tenant ID))