Contents x
    Microsoft Entra ID (formerly Azure Active Directory) (SCIM)
    • 28 Nov 2024
    • 3 Minutes to read
    • Contributors
      Contents

      Microsoft Entra ID (formerly Azure Active Directory) (SCIM)

      • Updated on 28 Nov 2024
      • 3 Minutes to read
      • Contributors
        Article summary

        High-Level Procedure

        Part 1: Configure Entra ID

        Step 1 - Creating an application in Entra ID

        1. Access the Microsoft Azure Portal using administrator credentials.
        2. From Azure services, click Microsoft Entra ID.
        3. Click Overview.
        4. From the Basic information section, make a note of the License.
        5. Go to Manage > Enterprise applications.
        6. Go to All applications.
        7. Click New application.
        8. In the Browse Microsoft Entra Gallery page, click Create your own application.
        9. In the Create your own application panel that appears on the right, enter the application name (for example, Harmony SASE) and click Create.
          Once the application is created, the Overview page appears.
        10. Click the icon next to Application ID to copy it.
        11. Click Assign users and groups and then click Add user/group.
        12. In the Users section, click None Selected.
        13. Select the users and groups you want to add to the application and click Select.
        14. Click Assign.
        15. Click Enterprise applications in the top left corner.
        16. From the left panel, click App registrations.
        17. In the All applications tab, click the application you created.
        18. Go to Manage > Authentication and click Add a platform.
        19. In the Configure platforms panel that appears on the right, click Web.
        20. In the Redirect URIs field, enter your workspace name and click Configure:
        21. In the Redirect URIs section, click Add URI and add these:
        22. In the Front-channel logout URL section, enter your workspace name:
        23. In the Supported account types section, select the applicable option for supported account types and click Save.

        Step 2 - Configuring API Permissions

        1. From the left panel, click Manage > API permissions and then click Add a permission.
          The Request API permissions panel appears to the right. 
        2. Select Microsoft APIs tab and then select Microsoft Graph.
        3. Click Delegated permissions.
        4. Click Directory to view the permissions and then select Directory.Read.All.
        5. Click User to view the permissions and then select User.Read.All.
        6. Scroll to the top of the page and click Application permissions.
        7. Click Directory to view the permissions and then select Directory.Read.All.
        8. Scroll to the bottom of the page and click Add permissions.
        9. Click Grant admin.
          The Grant admin consent confirmation window appears.
        10. Click Yes.

        Step 3 - Configuring Secret Key for the Application

        1. From the left panel, select Certificates & secrets and click the Client secrets tab.
        2. Click New client secret.
          Note - You must use this client secret (password) as the Client Secret when connecting with the Harmony SASE IDP. 
        3.  In the Add a client secret panel that appears on the right, specify these:
          1. Description - Enter a description.
          2. Expires - Select the secret expiration from the list.
        4. Click Add.
        5. To copy the secret value, in the Value field, click .

        Part 2: Configuring Harmony SASE IDP

        1. Access the Harmony SASE Administrator Portal. 
        2. Go to Settings > Identity Providers.
        3. Click Add Provider.
          The Add identity provider window appears.
        4. Select Microsoft Azure AD and click Continue.
        5. Enter these details:
          • Microsoft Azure AD Domain
          • (Optional) Domain Aliases
          • Client ID (you copied while configuring the key)
          • Client Secret

        6. In the Azure AD Edition section, select your Azure premium type that you noted in step 4 of Creating an application in Entra ID: 
          • P1
          • P2
        7. Select the SCIM Integration checkbox.
        8. Click Done.
          The Azure AD gets created successfully.
        9. In the Microsoft Azure AD section, click Settings.
        10. Click Generate Token.

          The Azure AD SCIM Data window appears.
        11. Copy the URL and Token and then click Close.

        Part 3: Configuring SCIM

        1. Access the Microsoft Azure Portal using administrator credentials.
        2. Go to Entra ID > Enterprise Applications and click New application.
        3. From the Browse Microsoft Entra Gallery, click Create your own application.
        4. In the Name field, enter a name and click Create.
        5. Once the application is created, go to Manage > Provisioning.
        6. Click Get Started in the Provision User Accounts tile.
        7. From the Provisioning Mode list, select Automatic.
        8. Expand Admin Credentials.
        9. In the Tenant URL field, enter the SCIM URL.
        10. In the Secret Token field, paste the token you copied in Part 2: Configuring Harmony SASE IDP section step 11.
        11. Click Test Connection.
        12. Click Save at the top left corner.
        13. Expand Mappings.
        14. Make sure that these options are enabled:
          1. Provision Microsoft Entra ID Groups
          2. Provision Microsoft Entra ID Users
        15. Click Provision Microsoft Entra ID Users.
        16. In the Attribute Mappings section, for userName, click Edit.
        17. From the Source attribute list, select mail.
        18. From the Match precedence list, select 2.
        19. Click OK.
        20. Locate the emails[type eq “work”].value attribute and click Edit.
        21. From the Source attribute list, select userPrincipalName.
        22. From the Match objects using this attribute list, select Yes.
        23. From the Matching precedence list, select 1.
        24. Click OK.
        25. Go back to Attribute Mappings section and for userName, click Edit.
        26. From the Match objects using this attribute list, select No.
        27. Click OK.
        28. Retain these attributes and delete other attributes:
          • emails[type eq “work”].value
          • userNamemail
          • active
          • name.givenName
          • name.familyNamesurname
        29. Click Save.
        30. Go to SCIM Application and select Users and groups.
        31. Click Add users/group.
        32. In the Users section, click None Selected.
        33. Select the user(s).
        34. Click Select and then click Assign.
        35. Go to the SCIM application.
        36. Go to Manage > Provisioning.
        37. Click Start provisioning.
        Was this article helpful?
        What's Next