Importing Users from Azure AD

Azure AD is a cloud-based application that helps in identity and access management. It allows you to access any registered application from any location. In Azure AD, you can register your Access Manager Plus and can import users and user groups from there. Now, the users will be able to sign-in into Access Manager Plus using their Azure AD credentials in both Windows and Linux platforms. Apart from Azure AD, you can also import users from your Active Directory.

Summary of Steps

  1. Registering Access Manager Plus in Azure AD portal
  2. Steps to import Users from Azure AD

    3. 2.1 Importing Users from Azure AD

    2.2 Specifying Appropriate User Roles

    2.3 Enabling Azure AD Authentication

1. Registering Access Manager Plus in Azure AD Portal

To integrate Access Manager Plus with Azure AD and import users, Access Manager Plus should first be added as a native client application in your Azure AD portal. Follow the steps given below to register Access Manager Plus as an application:

  1. Login to your Microsoft Azure portal.
  2. Click App registrations from the left pane under Manage.
  3. Click + New registration from the top bar.
  4. In the Register an application page, enter the following attributes:
    1. Enter Name as Access Manager Plus or any name of your choice
    2. Choose Supported account types - Accounts in this organizational directory only - Single tenant)
    3. Enter the Redirect URI of Access Manager Plus application
  5. Click Register. Access Manager Plus will be added as an application in Azure AD.
  6. You will be taken to the page with the details of the newly registered Access Manager Plus application.
  7. Click API permissions under Manage in the left pane. In the API Permissions page, click +Add a permission.
  8. In the Request API Permissions page, choose Azure AD Directory Graph under Supported Legacy APIs.
  9. Click Delegated Permissions and search for "read" in the Select Permissions search bar to populate relevant permissions. Select the options Directory.Read.All, User.Read and click Add Permissions.
  10. Now, click the Grant admin consent button under Grant Consent.
  11. In the pop up that opens, click Yes to grant consent for the requested permissions.
Once you have registered Access Manager Plus with appropriate permissions, go to Access Manager Plus's web interface and start importing users using the steps detailed below.

2. Steps to Import Users from Azure AD

  1. Log in to Access Manager Plus and navigate to Admin >> Authentication >> Azure AD.
  2. The Azure AD Server Configuration page will be displayed, from where you need to perform the below sequence of steps:
    1. Importing users from Azure AD
    2. Specifying appropriate user roles
    3. Enabling Azure AD authentication

    3. Note: Alternatively, you can also carry out the import operation from Users >> Add Users >> Import from Azure AD. However, you have to go to Admin >> Authentication >> Azure AD to carry out Step 3 - enabling Azure AD authentication.

2.1 Importing Users from Azure AD

  1. In the Azure AD Server Configuration page, click Import Now. In the Import From Azure AD dialog box, enter the following attributes:

  2. Select Domain Name: Click the New Domain and add the Azure AD domain from which users and groups are to be imported.
  3. CLIENT ID: Enter the CLIENT ID generated in the Azure AD server while registering Access Manager Plus as a Native client application in your Azure portal.
  4. Username and Password: Enter a valid username and password with sufficient permissions to perform user import. Usually, the username will be a part of the domain name in the format: <username@domain.onmicrosoft.com>. For instance in testuser@ampdemo.onmicrosoft.com, <testuser> is the username. After entering the CLIENT ID and domain details, click Save to keep them auto-populated for future import operations. 
  5. Users to Import/User Groups to Import: To import only particular users and groups from Azure AD directory, enter the required user name(s) in comma separated form, in the field Users to Import, and required group names in User Groups to Import. [Optional Step]
  6. Synchronization Interval: Add a synchronization schedule to keep the user database constantly in sync with your Azure AD. In this field, enter the time interval at which Access Manager Plus has to query Azure AD and keep the user database in sync. [Optional Step]
  7. After entering the required details, click Fetch Groups. In case you have specified users/groups to import then click Import. Access Manager Plus will list all the user groups available in your Azure AD domain. Select required groups using the check boxes beside them and import users.
  8. Once the import is complete, Import Summary will be displayed with the number of users imported successfully and the ones failed. Once you click Close, you will be automatically taken to Step 2: changing appropriate user roles.

    Note: To view the synchronization schedules created for Azure AD user import, click View Synchronization Schedules in the Azure AD Server Configuration window.

2.2 Specifiy Appropriate User Roles

After import, all the users imported from Azure AD will be assigned the Standard User role as shown in the Change Roles for users dialog box.

  1. Click Change Role button against the users for whom you wish to change the role and choose an appropriate role from the drop-down.
  2. To change roles for users in bulk, select the users using the check boxes and click Change Role at the top and choose an appropriate role from the drop-down. The changes will be saved as and when the roles are assigned.

    Note: You can change the assigned roles anytime in the future by clicking on Assign Roles Now as shown in the image.

2.3 Enable Azure AD Authentication

The third step is to enable Azure AD authentication; enabling this will allow users to login to Access Manager Plus using their Azure AD domain password. Note that this feature will work only for users who have already been imported to the local database from Azure AD. Before enabling Azure AD authentication, ensure that AD authentication is disabled.

  1. Navigate to Admin >> Authentication >> Azure AD and click Enable Now under Enable Azure AD Authentication.

Note: Once Azure AD authentication is enabled, you can disable local authentication under Admin >> Settings >> General Settings >> User Management.

See also:
Top