The FortiClient SSO Mobility Agent is installed directly on client workstations. It monitors the user's Windows session status locally and sends logon and, crucially, logoff events directly to the FortiGate or FortiAuthenticator in real-time. This agent-based approach is transparent to the user and provides the most reliable method for logoff detection. It completely bypasses the need for a central Collector Agent to poll workstations using external mechanisms like WMI to verify if a user session is still active, directly addressing the requirements of the question.

A. RADIUS accounting reports the termination of a network access session (like VPN or 802.1X), not necessarily a user logging off their OS.

C. DC polling is effective for detecting user logons from event logs but is inherently unreliable for detecting logoffs, often requiring WMI polling to confirm session status.

D. Windows AD polling is functionally the same as DC polling and suffers from the same inability to reliably detect user logoffs without supplemental checks.

1. FortiAuthenticator 6.4 Administration Guide

Page 143

"FSSO Methods": "FortiClient SSO Mobility Agent... The agent is installed on clients and sends user logon information directly to FortiAuthenticator... This method provides reliable logoff detection."

2. Fortinet Single Sign-On (FSSO) 6.2 Administration Guide

Page 10

"FortiClient Single Sign-On Mobility Agent": "The FortiClient SSO Mobility Agent is an application that is installed on individual hosts. It allows the host to send user logon information directly to the FortiGate... This removes the need for polling."

3. FortiAuthenticator 6.2 Study Guide

Page 110

"FortiClient SSO Mobility Agent": "The agent is installed on clients and sends user logon information directly to FortiAuthenticator... This method provides reliable logoff detection." This source explicitly contrasts it with polling methods that have challenges with logoff detection.