Azure Active Directory (Enterprise Application)

This guide explains how to enable users to log in using a Microsoft Azure Active Directory account, either from your company or from external directories. 

The process involves registering your application through the Microsoft Azure portal

Steps

1. Log in to Microsoft Azure and choose Azure Active Directory from the sidebar.
   ֿ

2. Under Manage, select Enterprise applications.
3. Select New application and then Create your own application to add a new application.

4. Enter a name for the application (for example "P81"), leave the default settings as is, and click on Create.

5. Once the application was created, browse to App registrations, locate the created application, and click on it.

6. From the left pane select Authentication, click on Add a platform and select Web.

7. In the Configure Web screen, enter your workspace name: [https://workspace.perimeter81.com for US based platform or https://workspace.eu.sase.checkpoint.com for EU based platform] under the Redirect URIs and select Configure.

8. Under Redirect URLs  add the following link: https://auth.perimeter81.com/login/callback for US based platform or https://auth.eu.sase.checkpoint.com/login/callback for EU based platform

9. Select Save.

10. Under Front-channel logout URL enter your workspace name: [https://workspace.perimeter81.com for US based platform or https://workspace.eu.sase.checkpoint.com for EU based platform], under Supported account types, select the applicable option for Supported account types, and click on Save.

Configuring the permissions

1. From the left sidebar select API permissions.
   
2. Select Add a permission.
   
3. Select Microsoft APIs and choose Microsoft Graph to change the access level.
   

4. The following page displays:

5. The next step is to modify permissions so your app can read the directory. Under Delegated permissions, check next to Sign in and read user profile and Read directory data.
6. Grant Admin Consent if requested.

Support user groups

1. If you want to enable user group support you will need to enable the following permissions:

• Application Permissions: Read directory data
• Delegated Permissions: Access the directory as the signed-in user.

2. Select Save at the top to save these changes.
3. Grant Admin Consent if requested.

Allowing access from external organizations (optional)

1. If you want to allow users from external organizations (such as other Azure directories) to log in, you will need to enable the Multi-Tenant option for this application. In the Authentication section, choose the Multi-tenant option. 
2. Select Save at the top to save these changes.
3. Grant Admin Consent if requested.
   

Configuring the key

1. You will need to create a key (secret password) that will be used as the Client Secret in the Harmony SASE IDP connection. Select Certificates and secrets from the Application menu.
2. Click + New Client Secret
   
3. Enter a name for the key and choose the desired duration.
   • This is an expiring key, make sure to record the expiration date in your calendar, as you will need to renew the key (get a new one) before that day to ensure users don't experience a service interruption.
4. Select Add and the key will be displayed.

Configuring IDP connection

1. Log in to your Harmony SASE Management Platform, navigate to Settings, and then IdentityProviders.
   
2. Select + Add Provider.
3. Choose Microsoft Azure AD.
   
4. Fill in Microsoft Azure AD Domain (your domain - for example harmonysase.com), Domain Aliases (optional), Client ID, and Client Secret. 
   • The Client ID value is stored as the Application ID in Azure AD, you can copy that from the "Overview" section.
     
5. For the Client Secret use the value that was shown for the key when you created it in the previous step.
6. Under Domain set the name of the Microsoft Azure AD Domain and under Domain Aliases insert any email domain that you may be using.
7. Select Done.
   If your users are getting access errors after the configuration, please follow these steps.

Assigning Users/Groups

1. Log in to Microsoft Azure and choose Azure Active Directory from the sidebar.ֿ
   
   
2. Under Manage, select Enterprise applications.
   
   
3. Navigate to the enterprise application you created and click on “Users and groups” in the left-side navigation pane.
4. Click on “+ Add user/group” on the top action bar
5. On the next screen, under “Users and groups” click “None Selected.”
6. Search for the user(s)/group(s) that should be assigned to the SCIM application
7. Select the user(s)/group(s) and click on the “Select” button and then the “Assign” button
8. Those users/groups are now assigned to the application