A company has multiple business units, each of which manages its own user directories and identity providers (IdPs) with different domain names. The…

To configure GlobalProtect to authenticate users from multiple SAML identity providers (IdPs), the

correct approach involves creating multiple authentication profiles, one for each IdP. Here's the

analysis of each option:

Option A: GlobalProtect with multiple authentication profiles for each SAML IdP

GlobalProtect allows configuring multiple SAML authentication profiles, each corresponding to a

specific IdP.

These profiles are associated with the GlobalProtect portal or gateway. When users attempt to

authenticate, they can be directed to the appropriate IdP based on their domain or other attributes.

This is the correct approach to enable authentication for users from multiple IdPs.

Option B: Multiple authentication mode Cloud Identity Engine authentication profile for use on the

GlobalProtect portals and gateways

The Cloud Identity Engine (CIE) can synchronize identities from multiple directories, but it does not

directly support multiple SAML IdPs for a shared GlobalProtect setup.

This option is not applicable.

Option C: Authentication sequence that has multiple authentication profiles using different

authentication methods

Authentication sequences allow multiple authentication methods (e.g., LDAP, RADIUS, SAML) to be

tried in sequence for the same user, but they are not designed for handling multiple SAML IdPs.

This option is not appropriate for the scenario.

Option D: Multiple Cloud Identity Engine tenants for each business unit

Deploying multiple CIE tenants for each business unit adds unnecessary complexity and is not

required for configuring GlobalProtect to authenticate users to multiple SAML IdPs.

This option is not appropriate.