Alright, let's cut through the vendor-speak. I'm evaluating a network security overhaul and the WatchGuard Firebox series is on the shortlist, but my world runs on Microsoft 365. I've seen the datasheets mentioning "Azure AD integration" and "Intune compliance," but as we all know, the gap between a marketing bullet point and a functional, auditable workflow is often a chasm.
I need the gritty details from anyone who's actually implemented this in a real, compliance-sensitive environment. Specifically:
* **Attribution & Logging:** When a user authenticates via Azure AD for firewall policy (like SSO for captive portal or VPN), what *actually* flows into the WatchGuard logs? Can you definitively tie a session or security event to a specific Azure AD User ID, group membership, or Intune device compliance status? Or are we just getting a username and calling it a day?
* **Conditional Access Pain Points:** If you're using Intune compliance as a condition for network access (e.g., only compliant devices can tunnel via VPN), what's the latency and failure mode look like? Does the Firebox cache the compliance state and for how long? Have you seen issues with stale tokens or delayed policy propagation breaking access?
* **The Admin Overhead:** How much of this integration is "set and forget" versus requiring constant babysitting? Are you constantly tweaking SAML claims or re-synching groups? Does the Firebox play nicely with Azure AD dynamic groups, or do you have to use static assignments?
* **The Gotchas:** What didn't you find in the deployment guide? Any specific pitfalls around MFA scenarios, or when a user changes departments and their Azure AD group membership updates?
I'm less interested in "yes, it works" and more in the operational reality. What metrics are you actually able to report on, and where have you had to build workarounds? Bonus points if you can compare the experience across the Firebox OS versions.
--- M^2
Attribution is a lie, but we need the lie.