Configuring Entra SSO for Your Account

This article explains how to configure Microsoft Entra ID as the Single Sign-On (SSO) provider for SDP users, clientless users, and Cato Management Application (CMA) admins in your account.

SSO relies on an encrypted token from Cato and your IdP to validate that the user is authenticated and allowed to connect to the network. For more details, see SSO Authentication for Users with Cato.

For more about enabling SSO for the account, see Configuring SSO and the Subdomain for the Account.

Configuring Single Sign-On

With the Cato Single Sign-On (SSO), you can allow Cato users to use their existing Identity Provider (IdP) credentials without the need for dedicated credentials from Cato Networks. Users can connect to Cato using their email address or UPN (User Principal Name) as defined in Entra.

Overview of SSO with Your Cato Account

After a chain of trust is established between Cato, the IdP, and your company's user directory, Cato trusts the IdP for user authentication.

Cato SSO supports these Client operating systems:

• Windows

• macOS

• iOS

• Android

• Linux

Known Limitations

• Entra SSO operated by 21Vianet in China is not supported

Preparing to Configure SSO with Entra

Before you establish trust with Entra, make sure that you complete these prerequisites:

• The admin configuring SSO integration must be able to authenticate to Entra ID and have Global Administrator or Privileged Role Administrator privileges for the Azure tenant

  Note: The integration will fail if the CMA admin doesn't have an Entra ID account.

• For LDAP, Entra must be synchronized with your user directory in your Cato account

• For manually created SDP users, SSO is supported for Windows v5.x, macOS v5.x, and Linux v5.x Clients

  • For iOS and Android, only users who were imported from your organization to Cato using LDAP or SCIM provisioning are able to use SSO.

• The Profile for each Entra user must have a valid Email address.

Configuring SSO with Microsoft

This section explains how to configure SSO with Microsoft Entra from the CMA.

To configure SSO with Microsoft for your account:

1. From the navigation menu, select Access > Single Sign-On.

2. Click New.

3. From the Identity Provider drop-down menu, select Microsoft Entra.

4. Enter a Name.

5. Click Apply and in the Single Sign On page, click Save.

6. In the Single Sign On page, click on the provider you just created.

7. Click Set up Microsoft Consent.

   The Permissions requested pop up window is displayed.

   Note: Click Apply and then click Save. Then edit the entry for the Setup Microsoft Consent link to be enabled.

   

8. In the Permissions requested pop up window, click Accept. See below for more information. 

9. If prompted by the CMA to associate your Entra tenant with your Cato account, click Confirm.

10. If you are configuring one Single Sign-On provider, enable the Default toggle. If you are configuring multiple Single Sign-On providers, see Configuring Multiple Identity Providers

11. Click Apply.

12. Select Allow login with Single Sign-On for one or more types of users in your account:

    • Cato Client users (set the Token validity settings)

    • Clientless SDP users (set the Cookie type)

    • Browser Extension users

    • Cato Management Application admins

13. Click Save. The Entra SSO settings for your account are configured

Granting Cato Permissions

This section explains how to use the Cato Management Application to enable SSO with Microsoft Entra ID or Office 365.

To identify users, Cato requires consent to access user's data. As part of the configuration process, an administrator must grant the Cato SSO application access to data on behalf of your users. This does not provide admin rights on the tenant. For more information, see the Microsoft documentation.

Granting tenant-wide admin consent for Cato requires you to sign to Entraas a user authorized to consent on behalf of the organization (a Global Administrator or Privileged Role Administrator). For more information, see the Microsoft documentation.

For Cato Client users, when you configure the Token validity settings, you define in Days or Hours the amount of time that users remain authenticated. Users that are logged in must reauthenticate when the duration you define in Days or Hours (since they last logged in) has been reached. The Always Prompt option means that users must always authenticate to the Client.

Troubleshooting Entra SSO Connections

Article Changelog