FortiSASE treats the external identity provider as the authoritative source once SSO is enabled. The portal automatically suppresses any previously-defined local or cloud-native user-password authentication methods; users can log in only through the configured IdP credentials. (FortiSASE Administration Guide v23.4, “Enable Single Sign-On”, p.103-104).

B. FortiSASE supports IdP integration through SAML/OIDC only; it has no “public/private access type” configuration.

C. FortiSASE SSO applies to both agent-based and agentless (browser) access; recommendation is not limited to agents.

D. Users and groups are not imported or manually edited in FortiSASE; group membership is asserted dynamically by the IdP at login.

1. Fortinet. “FortiSASE Administration Guide v23.4”

Section “Enable Single Sign-On”

pp. 103-104.

2. Fortinet. “FortiSASE SAML & OIDC IdP Integration”

TechDocs KB FD542473

para. 2 (“Local user logins are disabled once SSO is enabled”).