Secure vendor remote access with MFA, Conditional Access, and Cisco

Vendor access should expire by design

An external technician does not need a permanent VPN into the entire network. They need a named identity, an approved window, and a constrained path to a few systems. The control must survive staff changes at the vendor, contract expiry, and a security incident.

MFA and Microsoft Entra Conditional Access significantly strengthen authentication, but they do not define which servers and ports become reachable after the tunnel opens. That authorization remains on the firewall through a group policy, VPN filter, Dynamic Access Policy, or RADIUS decision. A reliable design separates identity, session, and network access.

Four layers that must not be confused

A common mistake is to treat Entra group membership as an ACL. The group can produce a claim that Cisco interprets, but the firewall must still map that result to a policy and network rules. Deny should be the default when a claim is missing, ambiguous, or does not match a known policy.

1. Create a governed vendor identity in Microsoft Entra ID

Microsoft Entra B2B can keep the identity in the vendor's home tenant while applying resource-tenant policies. Explicitly decide whether MFA claims from the home tenant are trusted in cross-tenant access settings. Recognized methods and authentication requirements can differ by external identity type.

Application assignment is not network authorization. It only decides whether the identity can request a SAML assertion for the application.

• Use one named account per person and prohibit shared VPN accounts among technicians.
• Record an internal sponsor, vendor, contract number, expiry date, and emergency contact method.
• Enable Assignment required on the Cisco enterprise application and assign only approved vendor groups.
• Prefer direct membership in critical access groups; Microsoft advises against relying on nested groups for predictable application assignment.
• Where licensing allows, use access packages or recurring access reviews with expiry; otherwise schedule a manual review with an owner and deadline.

• Microsoft — Assignment required and AADSTS50105 ↗
• Microsoft — Govern external users with Entitlement Management ↗

2. Require MFA and roll out Conditional Access safely

Target the Cisco enterprise application with a Conditional Access policy for vendors. Require MFA or an authentication strength compatible with the selected external identities. Add only conditions the design can support, such as location, sign-in risk, platform, or device compliance. A vendor-owned endpoint is not automatically managed by your tenant.

Start in report-only mode, inspect sign-in logs, and test one account from each vendor and platform. Move to On in rings. Conditional Access requires Microsoft Entra ID P1; risk-based conditions require P2. Advanced governance features have separate licensing requirements.

Sign-in frequency can require a new authentication at the configured interval, but it is not a kill timer for an already-established tunnel. Cisco must also enforce session limits.

• Article — Move Conditional Access from report-only to enforced →
• Microsoft — MFA and authentication strength for external users ↗
• Microsoft — Conditional Access session controls ↗

3. Select a Cisco policy with a SAML claim

In Cisco's documented model for FTD and FMC 7.6, Microsoft Entra ID emits a claim named cisco_group_policy. Its value must exactly match the name of a Group Policy added to the Remote Access VPN policy. FTD uses that value to select the session policy.

In Entra, a claim condition can map one scoped vendor group to a value such as GP-VENDOR-HVAC. In FMC, that Group Policy receives its address pool, timers, Secure Client options, and most importantly its network filter. The default connection profile should fall into a policy with no useful access when the expected claim is absent.

Cisco warns that its FTD/FMC 7.6 example assumes a user matches only one group used for this assignment; multiple values can make group-policy selection problematic. Avoid overlapping vendor groups, test multi-group identities, and explicitly deny ambiguous results.

show saml metadata VENDOR-SAML
show vpn-sessiondb anyconnect

# Use only during a controlled test; debug output can expose attributes
debug webvpn saml 255
undebug all

• Cisco — Configure Group Policy assignment with Entra ID ↗
• Microsoft — Configure Cisco Secure Firewall with Entra ID ↗

4. Fictional example: vendor groups and minimum access

The following illustrates the design, not customer data. Names, addresses, and ports are fictional. Build the objects and ACLs in FMC, attach each filter to its Group Policy, and validate rule direction for the Cisco release and ACL type in use.

• Use a dedicated vendor address pool to simplify policy, investigation, and alerting.
• Allow one destination and port, then deny everything else; do not publish a whole subnet for convenience.
• Send administrative protocols through a jump host when the target cannot be isolated directly.
• Test one allowed destination and at least two prohibited destinations before production.

5. DAP, vpn-filter, and dACL are three different mechanisms

A vpn-filter is an ACL attached to the Group Policy that governs the remote session. A Dynamic Access Policy can match SAML attributes represented as aaa.saml.name, then continue, quarantine, terminate the session, or apply a network ACL. Cisco also documents multi-valued SAML attributes and their DAP indexing.

A downloadable ACL, or dACL, comes from a RADIUS authorization server such as Cisco ISE. It is downloaded in the RADIUS response; Entra ID does not directly carry a dACL in the SAML assertion. For a pure SAML architecture, use cisco_group_policy, DAP, and Cisco-managed ACLs. If ISE/RADIUS performs authorization, design and test that flow separately for the deployed FMC/FTD versions.

The right choice depends on governance. Static vpn-filters fit a few stable profiles. DAP helps combine attributes with an explicit deny. ISE is useful when the organization already centralizes RADIUS authorization and posture, at the cost of an additional dependency and licence.

• Cisco — SAML authorization for Remote Access VPN ↗
• Cisco — Dynamic Access Policy use cases on FTD ↗
• Cisco — VPN filters in a Group Policy ↗

6. Confine maintenance to a zone and jump host

Network least privilege reduces the impact of a compromised valid account. It does not replace target hardening: a separate local account, patches, logging, configuration backups, and application-level restrictions remain necessary.

• Separate the vendor VPN pool from employee endpoints and management networks.
• Restrict access to approved targets, ports, and windows; avoid any-any rules and lateral routing.
• Use a hardened jump host for RDP, SSH, web consoles, or proprietary tools when the target cannot provide fine-grained controls.
• Control file transfer, clipboard, downloads, and session recording according to risk and contractual obligations.
• Choose split tunnelling based on the context; document routes and test DNS resolution, traffic leakage, and the logging path.
• Never expose RDP, SSH, VNC, or an equipment console directly to the Internet to work around a VPN problem.

• Article — Secure Microsoft 365 administrative workstations →

7. Plan how to revoke an already-open session

Conditional Access evaluates authentication and supported reauthentication events. Removing a user from an Entra group, revoking tokens, or blocking the account prevents future authentication, but does not guarantee that an existing Cisco tunnel is immediately terminated. Cisco maintains its own session and timers.

The emergency procedure must therefore cover both sides: block Entra sign-in, remove application assignment or temporary access, revoke Entra sessions, and then disconnect the Remote Access VPN session in FMC or on the firewall. Confirm that reconnection fails and that logs cover the entire interval.

• Set an idle timeout and maximum connection time appropriate to maintenance windows.
• Close sessions at the end of sensitive work instead of waiting for expiry.
• Document who can disconnect a session when the network team is unavailable.
• Also revoke local accounts, SSH keys, certificates, or application secrets used outside Entra.

show vpn-sessiondb anyconnect
vpn-sessiondb logoff name vendor.user

• Microsoft — Revoke user access ↗
• Cisco — Monitor and disconnect VPN sessions ↗

8. Log evidence of access, not just the login

Synchronize time, centralize logs, and define retention based on risk. Cisco states that VPN syslogs are sent to FMC by default when a VPN configuration exists, but overly verbose levels can overload collection. Validate volume before enabling continuous debug logging.

• Entra logs: identity, application, Conditional Access, MFA method, source address, and result.
• Cisco events: connect, disconnect, profile, Group Policy, assigned IP, duration, and AAA/SAML failures.
• Firewall: permitted and denied flows from the vendor pool to internal destinations.
• Jump host and target: sign-in plus administrative commands or actions where supported.
• Ticket: approver, reason, window, participants, changes, and validation outcome.

• Cisco — FTD and FMC troubleshooting logs ↗

9. Deploy with a test matrix and rollback

Start with one pilot vendor, a non-critical target, and a window with local firewall access. Keep the previous profile only as a controlled, time-limited rollback that is not advertised to users. Back up FMC configuration, export useful SAML configuration, and record exact object names before deployment.

The cited Cisco guides include FTD/FMC 7.6. SAML authentication is supported on FTD from 6.7 and authorization from 7.0, but screens, attributes, and fixes vary by release. Check the matrix and Cisco advisories for the deployed version before reproducing the example.

• Cisco — SAML authentication on FMC-managed FTD ↗

Prerequisites and licences to budget

Confirm Cisco and Microsoft licensing for the targeted users, posture, ISE, and governance features. A lab design can be technically functional without satisfying production licensing rights.

• A valid Cisco Secure Client Advantage, Premier, or VPN Only licence for Remote Access VPN; posture and advanced modules vary by tier.
• An FTD/FMC release that supports SAML, the chosen authorization method, DAP, and required fixes.
• Microsoft Entra ID P1 for Conditional Access and P2 for risk-based policies.
• Appropriate licences for Entitlement Management and Access Reviews when they automate expiry and recertification.
• Public certificates, reliable DNS and time, and an out-of-band administration path for rollback.

• Cisco — Secure Client 5.x features and licensing ↗
• Microsoft — Microsoft Entra licensing ↗

When to request a complete design review

Request an architecture review when several vendors share systems, groups overlap, targets use legacy protocols, ISE participates in authorization, or production needs after-hours access. The review should connect identity, networking, logging, contracts, and the emergency procedure.

Targeted consulting can deliver the access matrix, Conditional Access policy, Cisco Group Policies and filters, allowed/denied tests, and an executable rollback. This guide helps scope the work; it does not replace validation against your actual versions, licences, and traffic flows.

• Service — Cybersecurity consulting →
• Service — Infrastructure architecture and modernization →