I85PREP
⌘ K
FCSS FortiSASE 25 Administrator study materials
FCSS FortiSASE 25 Administrator study resources

FCSS FortiSASE 25 Administrator: FortiSASE Deployment and Initial Configuration

FCSS FortiSASE 25 Administrator · Work through your exam, one topic at a time.

All guide sections

FortiSASE Deployment and Initial Configuration

Domain 1: FortiSASE Deployment and Initial Configuration

This domain tests whether you can provision a FortiSASE tenant and make it usable: licensing, region choice, administrator access, identity federation, endpoint onboarding, and a first working policy. Exam items usually describe a business topology and ask which setting must change, or which step must come first.

Core rules

  • Provision the instance from FortiCloud and choose a region/service edge deliberately. Region affects data residency and which PoPs users reach. Treat it as a design decision made before onboarding, not a toggle you flip later.
  • Licensing is user-based. A license count does not grant access by itself: users must resolve into groups that policies reference, through local accounts or a SAML identity provider.
  • Federate identity early. Configure the SAML IdP, map IdP groups to FortiSASE groups, and test the group claim before writing policy. If group mapping is wrong, every later rule is wrong.
  • Use separate administrator identities and least privilege; avoid daily work in the tenant-owner account.
  • Onboard endpoints with an invitation/activation code and a client profile. The profile controls auto-connect, PoP selection, and whether the client always tunnels.
  • Establish a baseline: CA certificate for SSL inspection, DNS settings, logging destination, and an allow/block policy that proves traffic reaches the service edge.

Worked example

A company has 400 users, headquarters in Frankfurt, and a sales team in Singapore. It buys 500 user licenses. The administrator creates the instance in the EU region because the private data and most users are in the EU. Entra ID is configured as SAML IdP and the group SASE-Sales is mapped. A client profile that auto-connects to the nearest PoP is assigned to that group. A test user signs in; the portal shows the user and device, and a baseline internet policy matches.

Reasoning: region is a residency and latency decision; group mapping turns a license into policy eligibility; the client profile is what makes the endpoint actually use the service edge.

Traps

  • Buying licenses but never mapping IdP groups, so policies never match.
  • Choosing a region for the administrator rather than for users and data.
  • Forgetting that activation codes/invitations expire and may be single-use.
  • Testing only with an administrator account that bypasses user policy.

Key points

  • Choose the FortiSASE region at provisioning; it sets data residency and PoP proximity.
  • A user license only becomes usable when the user resolves into a group referenced by policy.
  • Federate a SAML IdP and validate group claims before authoring rules.
  • Onboard endpoints with a client profile that defines auto-connect and PoP selection.
  • Baseline the tenant with CA certificate, DNS, logging, and a test policy.