This guide has three parts. It explains how to install and configure Firebox SSLVPN and IKEv2 with AuthPoint MFA with local users, on prem AD users and Entra ID users.

• Part 1 – Local User Authentication
• Part 2 – on prem Active Directory User Authentication
• Part 3 – Entra ID User Authentication

Part 3 – Entra ID User Authentication

In this guide, we only configure AuthPoint MFA and Microsoft Entra ID users for Firebox SSLVPN. IKEv2 VPN is not included, because it requires NPS (RADIUS) and Microsoft Entra Domain Services, which is usually too expensive and too complex for small and medium businesses.

Create an App Registration in Microsoft Entra ID

• Log in to the Microsoft Entra Admin Center.
• Go to App registrations and click New registration.
• Type a name for the application and click Register.

• Copy the Application (client) ID — you will need it in WatchGuard Cloud configuration.

Update the Manifest

• Open Manifest.
• Select the Microsoft Graph App Manifest tab.
• Set isFallbackPublicClient to true.
• Click Save.

Add API Permissions

• Go to API permissions → Add a permission.
• Select Microsoft Graph.
• Add these permissions:
  • Delegated permissions
    • User.Read
    • Device.Read.All
  • Application permissions
    • Group.Read.All
    • User.Read.All
    • Directory.ReadWrite.All
• Click Grant admin consent.

Enable Public Client Flow

• Go to Authentication → Settings.
• Make sure Allow public client flows is enabled.

Create a Client Secret

• Go to Certificates & secrets. Click New client secret.
• Add a description and choose when it expires. Click Add.
• Copy the Value of the client secret — you need this in WatchGuard Cloud configuration.
• ⚠ Important: You cannot view and copy the secret value later. If you lose it, you must create a new one.

Add Entra ID in WatchGuard Cloud

• In WatchGuard Cloud, go to Configure → Directories and Domain Services.
• Click Add Authentication Domain.
• Choose External Directory → Entra ID.
• Enter your Entra ID domain name.
• Paste the Application ID and Client Secret Value from Entra ID.

Start Directory Sync

• Open the Entra ID domain you created.
• Go to Directory Sync.
• Click Configure Sync Directory.
• Choose a sync interval and click Save.

• After a short time, you should see Users and Groups from Entra ID.

Add Entra ID as an External Identity in AuthPoint

• In AuthPoint, go to External Identities.
• Click Add External Identity.
• Select Directories and Domain Services.
• Enter a Name and choose your Entra ID domain

Sync Users and Groups

• In Sync Users and Groups, click Add Group Sync.
• Choose a Group from Entra ID.
• Set User Type to MFA user.
• If you do not want AuthPoint to automatically create mobile tokens or send activation emails, clear those checkboxes.

• Users in that Entra ID group should now appear in the AuthPoint Users list.

If you see users in Directories and Domain Services but not in AuthPoint Users, check the user in Entra ID. All three must be filled in:

• User Name
• First Name
• Email

If you left the default Automatically create a mobile token for this user enabled the user also receives email messages to activate a token in the AuthPoint mobile app.
If you cleared the Automatically create a mobile token for this user, go to the AuthPoint Users list choose the user and click the three dots menu and select Add New Token.

Open the Activation email and click the link in the email. This takes you to the Welcome to AuthPoint web page. If you have not done so, download and install the AuthPoint mobile app on your phone from Apple App Store or Google Play Store.

• If you opened the web page on your phone, tap the Activate button. This opens the AuthPoint app and activates your token.
• If you opened the web page on your computer, open the AuthPoint app on your phone and tap Activate in the app, then point the camera on your phone at the QR code on your computer screen.

You can see the token on the AuthPoint Users page.

Test that the users get a Push notification to the AuthPoint MFA app.

Your Firebox must be connected to WatchGuard Cloud before you continue.

To use AuthPoint as an authentication server on a Firebox running Fireware 12.7 or higher, you must add a Firebox resource in AuthPoint.

Add a Firebox Resource in AuthPoint

• In WatchGuard Cloud, go to Resources.
• Click Add Resource.
• From the Type list, select Firebox.
• In Name, type a descriptive name for this resource.
• From the Firebox drop‑down list, select the Firebox device you want to connect to AuthPoint.

After you add the Firebox resource, the AuthPoint authentication server is automatically enabled on the Firebox.

Configure Zero Trust Authentication Policies

To create an authentication policy:

• Go to WG Cloud > Configure > Zero Trust.
• Click Add Policy.
• Enter a name for the policy.
• In the Target section, choose the groups this policy applies to.
• You can select more than one group.
• In this example, select the SSLVPN-Users Entra-ID group you created earlier.
• In the Resources section, select the Firebox resource.
• In the Action section, choose Allow.
• Select Password and Push.
• Click Save.

Configure Firebox SSLVPN to Use AuthPoint MFA

In the Firebox settings for SSLVPN

• Enable the AuthPoint as Authentication Server.
• Add the AuthPoint group name in the Users and Groups section.
  (As I used the same SSLVPN-User group name in Entra ID that is also the default group name in Firebox SSLSVPN, I don’t need to add anything in SSLVPN Authentication settings.)

If you have multiple authentication servers and AuthPoint is not the default server, you must log in with: AuthPoint\user3

Final Result

When you connect with SSLVPN, you should receive an MFA Push notification on your mobile device.

If AuthPoint MFA does not work for an Entra ID user, you should first check the Sign‑in logs in Microsoft Entra ID. These logs will show if something — for example a Conditional Access policy — has blocked the AuthPoint MFA login attempt.

Trusted IPs Required for Entra ID + AuthPoint MFA

When you use Entra ID with AuthPoint MFA, you usually need to add the AuthPoint Entra ID Integration IP addresses as Trusted IPs in Microsoft Entra ID.
You configure this in:
Microsoft Entra ID → Conditional Access → Named locations
Add a new Named Location for the AuthPoint MFA IP addresses and mark it as Trusted.

Exclude AuthPoint MFA from Conditional Access Policies
In your Conditional Access policies, go to:
Conditions → Locations → Exclude
Then select the AuthPoint MFA Named Location you created.
This prevents Conditional Access from blocking AuthPoint MFA traffic.