Azure Site-to-Site VPN and Fortigate IPSec Phase 2 error on SA re-establishment - "peer SA proposal not match local policy"
The solution is to install a custom IPSec policy with Azure VPN Gateway as described in this Azure troubleshooting document. Make sure you pick compatible policy options (I chose AES256/SHA256 everywhere) and disable PFS. THe how-to is described here. When you follow the guide you will by default have no IPSec Policy installed - this is counter-intuitive as the gateway of course has a policy, but it is the default one and thus hidden. Just follow the guide.
Upvote or comment if you feel this has saved you some head banging.