![Azure Active Directory 1 614dfe71 image](https://www.agilicus.com/www/614dfe71-image.png)
Azure Active Directory
Sign-In With Microsoft with Policy
You can add one (or more) Azure Active Directory systems as Upstream Identity Providers. Doing this will allow your team to sign in with their Active Directory username/password. If you work with more than one corporation, you may add multiple Upstream Identity Providers.
Azure Active Directory
You can add one (or more) Azure Active Directory systems as Upstream Identity Providers. Doing this will allow your team to sign in with their Active Directory username/password. If you work with more than one corporation, you may add multiple Upstream Identity Providers.
Note: you can consider using the shared ‘Sign in with Microsoft’ Identity provider, which has zero-config. See considerations.
Agilicus Front-End Create Upstream Issuer
The setup is very simple and takes less than 2 minutes to acomplish. There is a ‘stepper’ that walks you through the tasks.
First, open the admin user interface (https://admin.YOURDOMAIN). Login as your (initial) administrative user. Nagivate to ‘Organisation’/’Authentication Issuer’. From here you may select ‘Add Provider’, adding a new identity provider.
![Azure Active Directory 2 b77387a9 image](https://www.agilicus.com/www/b77387a9-image.png)
At this stage, you will enter a Stepper which will walk you through the steps graphically. First select Azure Active Directory as the type:
![Azure Active Directory 3 a898230b image](https://www.agilicus.com/www/a898230b-image.png)
Azure Application Registration
The Stepper will show screen shots of how to configure Azure, they are also here. First, select ‘Azure Active Directory’ in your Azure console:
![Azure Active Directory 4 614dfe71 image](https://www.agilicus.com/www/614dfe71-image.png)
Now create a new Application. This will be for all logins to the Agilicus platform.
![Azure Active Directory 5 1afa6942 image](https://www.agilicus.com/www/1afa6942-image-1024x600.png)
Select a name. This will be shown to the user on the Login select page, we recommend making it related to your organisation. E.g. “My Company Active Directory”. In the Application stepper you are given a “Redirect URI”, paste it here.
![Azure Active Directory 6 1031aab2 image](https://www.agilicus.com/www/1031aab2-image.png)
You will now be given 3 pieces of information. A ‘Display Name’, an ‘Application (Client) ID’, and a ‘Directory (Tenant) ID’. Enter these in the appropriate spots in the Stepper.
Here you can see where this information is placed in the Agilicus Admin Stepper, from the Azure screen we have:
![Azure Active Directory 7 f1286f6b image](https://www.agilicus.com/www/f1286f6b-image-1024x816.png)
On the Agilicus Stepper we have:
![Azure Active Directory 8 d04b6a1d image](https://www.agilicus.com/www/d04b6a1d-image.png)
Now we create a ‘Client Secret’. This is a shared secret between the two systems. Create this in the Azure Portal:
![Azure Active Directory 9 c048db09 image](https://www.agilicus.com/www/c048db09-image-1024x544.png)
As a description we recommend using the same name as for the Application. If you select an Expiry (e.g. something other than Never) you must remember to update the Admin user interface at a later date.
![Azure Active Directory 10 3467f491 image](https://www.agilicus.com/www/3467f491-image.png)
In the Admin stepper paste the secret you received. You are now done!
![Azure Active Directory 11 a5067979 image](https://www.agilicus.com/www/a5067979-image.png)
NOTE: Multiple Azure tenant with same email address
❗
If your Active Directory login name is the same as the email address you provided through your Apple ID / Google ID / LinkedIn ID, you may have an issue. Please contact Agilicus (info @ agilicus.com) and we can join these accounts for you. E.g. if your Apple ID email is foo@mycompany, and your Active DIrectory is foo@mycompany, let us know and we can join these two together.
Azure Claims
This section is optional. If you wish to synchronise groups, or use UPN as welll as email, you should configure a set of additional claims. Agilicus recommends:
- email — this gives access to the user ’email’ which may differ from the UPN
- onprem_sid — this is used if you will do passthrough authentication (e.g. using SAML with Citrix), or fine-grained access control on a Share
- upn — this gives access to the user principal name
- sid — this can be used to allow per session sign-out
- preferred_username — this controls how the user might interact with the system as a name
![Azure Active Directory 12 a3ed4875 image](https://www.agilicus.com/www/a3ed4875-image-1024x631.png)
(Optional) Azure Groups
You may wish to directly import your Azure groups into Agilicus for role-based access control. To do so, enable the groups claim in Azure.
![Azure Active Directory 13 a0a5823e image](https://www.agilicus.com/www/a0a5823e-image-1024x402.png)
On your Azure Upstream Identity Issuer, enable the group mapping as below. You may need to use the GUUID and map to names.
![Azure Active Directory 14 bafff4f2 image](https://www.agilicus.com/www/bafff4f2-image-1024x516.png)
Testing and Application Consent
At this stage you may try a login. You can keep the Admin portal logged in and use https://profile.MYDOMAIN to try. You should see a new Sign-In option, which is named as you have above.
![Azure Active Directory 15 5fdebd27 image](https://www.agilicus.com/www/5fdebd27-image.png)
The first (and only) time you select this new Sign in option, you will be presented with a question as to whether you consent to the information shared. The Information shared is your Name, and your Email. No permission is being granted to access any Azure or Office 365 information.
![Azure Active Directory 16 95ccb7b6 image](https://www.agilicus.com/www/95ccb7b6-image.png)
You are now complete. All users can now Sign in with their corporate login, no additional passwords to remember.
Advanced Grant Workflow
NOTE: If you use advanced grant workflow
❗
If you do not do this, you may find that users who use the ‘offline_access’ workflow (also known as the refresh token) may be confused by constantly being requested to grant access.
![Azure Active Directory 17 bd0aab7b azure ea](https://www.agilicus.com/www/bd0aab7b-azure-ea.png)
![Azure Active Directory 18 77f170bf azure ea perm](https://www.agilicus.com/www/77f170bf-azure-ea-perm.png)
![Azure Active Directory 19 cfdf2aa4 azure ea add perm](https://www.agilicus.com/www/cfdf2aa4-azure-ea-add-perm.png)