A company has multiple business units, each of which manages its own user directories and identity providers (IdPs) with different domain names. The…

To support multiple SAML Identity Providers (IdPs) for GlobalProtect, you configure multiple Authentication profiles, one for each IdP. On the GlobalProtect portal's authentication tab, you can add these profiles. This configuration presents a drop-down menu on the GlobalProtect login page, allowing users to select their appropriate business unit or IdP. The firewall then initiates the SAML authentication flow with the selected IdP, enabling a shared remote access service while accommodating diverse identity sources.

B. The Cloud Identity Engine (CIE) is used for user-to-IP mapping and group retrieval, not as the primary mechanism for multi-IdP SAML authentication in GlobalProtect.
C. An authentication sequence chains multiple authentication methods for a single user's login attempt (e.g., password + MFA), it does not allow for selecting between different IdPs.
D. While multiple CIE tenants could exist, this is not the direct configuration on the firewall to enable GlobalProtect to authenticate against multiple SAML IdPs.

Palo Alto Networks. (2023). GlobalProtect™ Administrator's Guide Version 11.0. "Configure the GlobalProtect Portal." In the section "Set Up Portal Authentication," it details how to add multiple authentication profiles to allow users to select their authentication method.