How to set up integration with Azure active directory

Here is the guide to set up user provisioning and single sign-on with Azure AD

This article presents the way to set up the Microsoft Azure integration within Izix and its different possibilities. 

How to set up the integration with Azure directory 

1. Add our non-gallery azure application (mandatory)

1.1 Integrate Izix App inside Azure

1. 1. Connect on Azure https://portal.azure.com/ as an admin member of your organization. 
   2. Go to “Microsoft Entra ID” by clicking on the following icon in the action bar on top of the screen
      
      
      
      
   3. On the left menu, in the “Manage” section, go to “App registrations”
      
      
      
      
      
   4. Click on “+ New registration” in the action bar of the page
      
      
      
      
   5. To register a new application, enter the name and information requested in the form :
      
      

      Item	Action	Note
      Name	Type: “Izix”
      Supported account types	Select the preferred option	We advise you to use the first option “single tenant” in case you do not know the preferences of your organization. Use the “Help me choose…” button if needed
      Redirect URL	Leave empty
      Confirm	Click: Register

      
      
      
      
   6. In your list of applications, click on the newly registered app.
      
      
   7. In the left pane “Manage” menu, go to the “Branding” section (first sub-menu).
      
      
      1. You can upload an image to use as the icon for the Izix application on Azure (optional). Download our Izix icon by accessing the following link:  https://izix.eu/img/logo_bepark/bepark-business-app-icon.png
      2. Set the “Home page URL” to https://app.izix.eu (required)
      3. Save your changes by clicking on “Save” in the action bar of the page
         
         
         
         

1.2  Configuration inside Izix

1. 1. Go to the panel of Azure integration inside Izix. Select “Azure AD”  
      1. You can also reach the page from here: https://app.izix.eu/ > Settings > Integrations > SSO > Azure AD
         
         
   2. On the overview of the newly created Application inside Azure, you have the “Application (client) ID”. Copy-Paste it inside the “CLIENT ID” field in the Izix Azure configuration.
      
      
      
   3. In the left pane “Manage” menu inside Azure, go to the “Certificates & Secrets” section (3rd sub-menu).
      
      
      
      
   4. Click on “New client secret”, enter a description and select the period you want to Refresh the token. ( Keep in mind that you’ll have to update it in Izix when it will expire )
      
   5. Go back to Izix, copy the key displayed in the “Client secret” list in the column Value, and paste it into the “CLIENT SECRET” field in Izix
      
      
      
      

2. Add Azure Group & Synchronize them 

This section refers to the setup of the user provisioning. This section can be skipped if integration only aims to set up the SSO.

2.1 Configure your Azure Group in Izix

1. 1. Go to the panel of Azure integration inside Izix. Select “Azure AD” and then "Edit" on the top left.
      
      
   2. For each new group you want to add, click the “+” button in the bottom section. There you can select which roles you want to attribute to the users of this group and their languages.
      
      
   3. Go back to Azure > Microsoft Entra ID > App Registrations, select the registered application, and go to “API permissions” in the left pane menu.
      
      
      
      
   4. The permissions required for the app is User.Read, User.ReadBasic.All and Directory.Read.All if you want to be able to synchronize your user in our system.
      1. To add permissions:
         1. Click on “Add a permission”
         2. Select “Microsoft Graph“ in the first block of options
         3. Select “Delegated permission”
         4. In the search box, search for the missing permissions
         5. Select the permissions to add by clicking on the tickbox
         6. Click on “Add permissions” at the bottom of the page
         7. Back on the permissions overview, click on “Grant admin consent for (...)” and answer “Yes” (see the first image of this section of the document).
            
            
            
            
   5. Go to “Manifest” in the left pane menu (last menu of the “Manage” section)
      1. Find the key “appRoles”
         
         
      2. Replace it with the following code : 
         

         1.  "appRoles": [
        {
            "allowedMemberTypes": [
                "User"
            ],
            "description": "Manage stuff with this role",  // Description of the role
            "displayName": "Manager Role",        // Name of the role
            "id": "148a37e2-77ed-4485-8e73-ab02dfc2d151", // Your UUID Generated, the ID of the role (https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-add-app-roles-in-azure-ad-apps)
            "isEnabled": true,
            "lang": null,
            "origin": "Application",
            "value": "manager"
        }
    ],

         
         

         

      3. Save your changes by clicking on “Save”

2.2  Synchronize your user inside Izix

1. 1. For each group you want to synchronize with Izix: 
      1. Enter a tag to attribute to all the users of this group in the 1.
      2. Copy/paste the “Object ID” of the group from the group information page on Azure (search “Groups” in the search bar, click on the group name to see the details of the group) in the 2
      3. Select the roles to attribute to the profiles of the group in 3 (always leave the “Not registered” and “Simple user” roles selected)
      4. Select the language of the Izix application for the profiles of the group in the 4
         

3.  Allow user to log in to Izix using Azure

3.1  Common Settings

1. 1.  Go to Izix > Settings > Integration > SSO > Azure and copy the two callback URLs in the “URL to whitelist in your Azure application (Redirect or Reply URL)”
   2. Go back to Azure > Microsoft Entra ID > App Registrations, and access the overview of the registered application by clicking on the application name.
      1. Click on the link next to “Redirect URIs” - Depending on the user journey you followed on Azure, you might not be able to record the two callback URLs from Izix immediately. To do so, you have to add a platform by taking the following steps :
         1. Click on “+ Add a platform”
         2. Select “Web” under Web Applications
         3. Copy the first of the two callback URLs
         4. Leave the Logout URL empty
         5. Click “Configure” and skip step b hereafter as you already added the first of the two callback URLs in this step
      2. Enter the first of the two callback Url
         
         
      3. Get the second URL from the previous step in the field under “Redirect URIs”
         1. Click on “Add URI”
         2. Enter the second callback URL copied at the previous step in the new field
         3. Enter https://business.bepark.eu/logout in the field under Logout URL
         4. Save your changes by clicking on “Save” in the action bar of the page
            

      4. Now you need to add another platform for mobile application authentication with Azure SSO.

         1. For Android applications: 

            1. Click on “+ Add a platform” a new Time

            2. Select “Android” under Desktop and mobile apps

            3. Enter package name and Signature hash information

               1. Package name: com.bepark.besaas

               2. Hash information: VzSiQcXRmi2kyjzcA+mYLEtbGVs=

            4. Click “Configure” and Finished

            5. The redirect URL should be now:

               1. msauth://com.bepark.besaas/VzSiQcXRmi2kyjzcA%2BmYLEtbGVs%3D

            
            
         2. For iOS (Apple) applications:

            1. Click on “+ Add a platform” a new Time

            2. Select “iOS / macOs” under Desktop and mobile apps

            3. Enter Bundle ID

               1. Bundle ID: com.bepark.besaas

            4. Click “Configure” and Finished

            5. The redirect URL should be now:

               1. msauth.com.bepark.besaas://auth

            
         3. The result should be this -> 

3.2  Previously imported users

1. Go back to Azure > Microsoft Entra ID > Enterprise Applications in the left pane menu.
   1. Click on the Izix application you just registered
   2. Go to “Properties“ in the left pane menu and update the information with the following parameters : 
      1. Enable for users to sign-in? Yes
      2. User assignment required? 
         1. Select Yes if you want to allow only some selected users to use the integration
         2. Select No if you want to let any of your users use the integration.
      3. Save your changes by clicking on “Save” 
         
2. Go to Izix > Settings > Integrations > SSO > Azure AD
   1. Click on “Import” in the action bar of the screen
   2. Log in to Azure with your own credentials

Congratulations, your Azure Directory has now been uploaded to Izix. To make sure of that, go to Izix > Organisation > Profiles and check that the users and information you configured in Azure have been well imported.

3.3  Users created externally from Azure importation

1. 1. Allow Login for user created externally from azure importation
      
      
   2. Add authorized domains

Add the list of domains that will be allowed to connect through your azure integration. It means that if a user with an email coming from this domain tries to connect to our system with Azure, we will check if this user is present in your organization. If yes, he will be connected to your organization.

This is mandatory to be able to use this option. 

(Example : The domain is what is after the @ such as “izix.eu” - with email as john.doe@izix.eu )