Which authentication method overrides any other previously configured user authentication on FortiSASE?

The correct answer is B. SSO. The FortiSASE Administrator Study Guide explicitly states that enabling SSO authentication overrides any other previously created authentication methods, including the local user database, LDAP, and RADIUS.

FortiSASE implements SSO for endpoint users through SAML. In this design, FortiSASE functions as the service provider (SP), while authentication is performed by an external identity provider (IdP), such as Okta, FortiAuthenticator, or another supported IdP. The user database therefore does not need to be hosted directly on FortiSASE. Instead, FortiSASE redirects the user to the IdP and uses the resulting SAML assertion to establish the authenticated SSO session. The study guide confirms that SSO can be configured for both VPN users and Secure Web Gateway (SWG) users.

A. Local and C. RADIUS are authentication sources that SSO supersedes when SSO is enabled. D. MFA is an additional authentication-strength mechanism rather than the FortiSASE authentication mode described as overriding previously configured methods.

Study Guide Reference: User Onboarding and Additional Features > Configuring SSO > VPN User SSO / SWG User SSO, FortiSASE Administrator Study Guide, page 56.