An administrator decides to use the Use managed identity option on the FortiGate SDN connector with Microsoft Azure. However, the SDN connector is failing on the connection. What must the…

Question

Options

• AMake sure to add the Client Secret on the FortiGate side of the configuration.
• BMake sure to add the Tenant ID on the FortiGate side of the configuration.
• CMake sure to enable the system-assigned managed identity on Azure.
• DMake sure to set the type to system managed identity on FortiGate SDN connector settings.

• A
  17% (6)
• B
  8% (3)
• C
  72% (26)
• D
  3% (1)

Explanation

When using managed identity authentication, FortiGate delegates credential management entirely to Azure - but Azure's system-assigned managed identity must be explicitly enabled on the VM or resource hosting FortiGate before Azure can issue the identity token the SDN connector needs. Without it, there is no identity for Azure to present, so the connection fails regardless of FortiGate's configuration.

Why the distractors are wrong:

• A (Client Secret): Client secrets belong to service principal authentication, not managed identity. The whole point of managed identity is to eliminate the need for secrets.
• B (Tenant ID): Tenant ID is also a service principal concept. With managed identity, Azure automatically resolves the tenant context from the VM's identity.
• D (Set type on FortiGate): The question states the admin already selected the managed identity option on FortiGate - that side is done. The gap is on the Azure side, not a misconfigured FortiGate type setting.

Memory tip: Think of it as a two-switch problem - FortiGate's switch is already flipped (managed identity selected), but Azure's switch (system-assigned managed identity enabled on the VM) must also be ON before the circuit completes.

No community discussion yet for this question.