SSO Wrapping for Third-Party Credential Providers on Windows Endpoints

On Windows 7 and Windows Vista endpoints, the GlobalProtect agent utilizes the Microsoft credential provider framework to support single sign-on (SSO). With SSO, the GlobalProtect credential provider wraps the Windows native credential provider, which enables GlobalProtect to use Windows login credentials to automatically authenticate and connect to the GlobalProtect portal and gateway.
In some scenarios when other third-party credential providers also exist on the client, the GlobalProtect credential provider is unable to gather a user's Windows login credentials and, as a result, GlobalProtect fails to automatically connect to the GlobalProtect portal and gateway. If SSO fails, you can identify the third-party credential provider and then configure the GlobalProtect agent to wrap those third-party credentials, which enables users to successfully authenticate to Windows, GlobalProtect, and the third-party credential provider—all in a single step—using only their Windows login credentials when they log in to their Windows system.
Optionally, you can configure Windows to display separate login tiles: one for each third-party credential provider and another for the native Windows login. This is useful when a third-party credential provider adds additional functionality in the login tile that does not apply to GlobalProtect.
GlobalProtect SSO wrapping for third-party credential providers (CPs) is dependent on the third-party CP settings and, in some cases, GlobalProtect SSO wrapping might not work correctly if the third-party CP implementation does not allow GlobalProtect to successfully wrap their CP.
Use the Windows registry or the Windows Installer (Msiexec) to allow GlobalProtect to wrap third-party credentials:

Related Documentation