Microsoft Entra ID

1. Log in to your Azure portal.

2. In the home directory, click on the hamburger button to show the portal menu.

3. Go to Microsoft Entra ID > Enterprise applications> All applications.

   Important - Check Point does not support the preconfigured Check Point Portal application in Microsoft Azure. You must create a new application for Check Point Portal in Microsoft Azure as shown in this procedure.

4. Click New application.

   

5. Click Create your own application.

6. In the What’s the name of your app field, enter a name for the application (example: "Check Point Portal") and click Integrate any other application you don’t find in the gallery (Non-gallery).

   

7. Click Create and wait for Azure to add the new application.

1. Click on the Azure portal menu.

2. Click Microsoft Entra ID.

3. Click Groups.

4. Click New group.

   The New Group window opens.

5. Enter a Group name and Group description.

6. Add members to the group.

7. Click Create and wait for Azure to successfully create the group.

1. Open the enterprise application you created for the Check Point Portal.

2. Click Assign users and groups.

3. Click Add user/group.

4. Click None Selected.

5. Search for the group you created for Check Point Portal users.

6. Click the group and click Select.

7. Click Assign to assign the group to the application.

8. Open the user group.

9. Copy the group's Object Id.

1. In the Check Point Portal tenant that administrators should access through Azure SSO, click > User Groups.

2. Click New.

   The ADD USER GROUP window opens.

3. Enter a Name for the group.

4. Enter a Description for the group.

5. In the IDP Id field, paste the Object ID of the group from the Azure portal.

6. Assign a role to the group. For more information, see User Groups.

7. Click ADD.

1. Select Enable Administrators to log in to the portal using this IdP.

2. Select one of these options:

   • Login based on domain verification - Check Point Portal Administrators can log in to this Check Point Portal account with SSO from the Identity Provider. Administrators log in through the Check Point Portal login page.

   • Login with a unique URL - Check Point Portal Administrators can log in to multiple Check Point Portal accounts with SSO from the Identity Provider. Administrators log in using the URL that appears at the bottom of the Login with a unique URL section. Copy this URL and keep it in a safe place.

1. In the Service(s) Integration section, select one of these options:

   • No Services - End users of Check Point Portal services cannot authenticate with SSO from the Identity Provider. This is the default configuration.

   • All Services - End users can log in with SSO from the Identity Provider to all Check Point services that support SSO.

   • Specific Service(s) - From the list of services, select service(s) to allow end users to log in with SSO from the Identity Provider. Available services:

     • Connect

     • Quantum Gateways

2. Click Next (or, if you are editing a configuration, Apply) to complete the Integration Type configuration.

Step 1: Copy tokens from the Check Point Portal to the Azure portal

1. In the Check Point Portal IdP Integration Allow Connectivity page, copy the Identifier (Entity ID) and the Reply URL.

2. In the Azure portal, click Enterprise Applications.

3. Open the Azure application you use for the Check Point Portal.

4. From the left menu, expand Manage and click Single sign-on.

5. On the Select a single sign-on method page, select SAML.

6. In the Basic SAML Configuration section, click Edit and do these steps:

   1. In the Identifier (Entity ID) text box, paste the Identifier (Entity ID) you copied from the Check Point Portal.

   2. In the Reply URL (Assertion Consumer Service URL) / ACS URL text box, paste the Reply URL you copied from the Check Point Portal

7. Optional - Enable IdP-initiated login flow. IdP-initiated flow lets you connect directly to the Check Point Portal from your Azure portal.

   1. In the Azure portal, create an app card for the Check Point Portal. See the Microsoft Entra ID documentation for App integrations.

   2. Copy the Sign on URL from the Check Point Portal to the Sign on URL field in the Azure portal.

   3. Copy the Relay State from the Check Point Portal to the Relay State field in the Azure portal.

   4. Click Save.

8. If you did not do the previous optional step - In the Azure portal, Basic SAML Configuration window, click Save.

Step 2: Configure Attributes and Claims in the Azure portal

1. In the Azure application you created for the Check Point Portal > Attributes & Claims section, click Edit.

2. Make sure that these claims are in the User Attributes & Claims list. If a claim does not exist, then create it.

   Important - Do not change the default configurations of these claims.

   • Claim Name - http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

     Claim Type - SAML

     Value - user.mail

   • Claim Name -http://schemas.xmlsoap.org/ws/2005/05/identity/claim/givenname

     Claim Type - SAML

     Value - user.givenname

Step 3: Add a Group Claim in the Azure portal

1. In the Azure application you created for the Check Point Portal > Attributes & Claims section, click Edit.

2. Click Add a group claim.

   The Group Claims window opens.

3. Select Groups assigned to the application.

   Important - Nested groups are supported only if you configure Directory Integration with Manual Sync. See Directory Integration.

4. For Source attribute, select Group ID.

5. Click Save.

6. In the Check Point Portal, click Next/Apply.

In the Azure Portal, set up users and groups synchronization:

Set up permissions to allow the selection of users and user groups from your Microsoft Entra ID environment in the Check Point Portal Policy.

1. In the Azure portal, click App registrations.

   The App registrations screen opens.

2. Click + New registration.

   The Register an application screen opens.

3. Create a new App Registration.

   The app registrations page for the application opens.

4. Click Manage > API permissions.

   The API permissions screen opens.

5. In Configured permissions, click + Add a permission.

   The Request API permissions window opens.

6. In Microsoft APIs, click Microsoft Graph and select Application permissions.

7. In the Select permissions section:

   1. In the search field, enter Group:

      1. Expand Group.

      2. Select Group.Read.All.

      

   2. In the search field, enter User:

      1. Expand User.

      2. Select User.Read.All.

   3. Set up synchronization for device information:

      1. In the search field, enter Device.

      2. Expand Device.

      3. Select Device.Read.All.

      

8. Click Add permissions.

9. In Configured permissions, click Grant admin consent for <application name> and confirm in the confirmation window.

   The Status changes accordingly.

   

10. Create an authentication secret key:

    1. In the Azure portal, open your app and click Certificates & secrets.

       

    2. Click Client secrets > + New client secret.

    3. In the Description field, enter a description for the client's secret.

    4. Select an expiration date and click Add.

       

    5. From the Value field, copy the value of this new client secret.

       Use this value in the next configuration step.

       Note - You cannot retrieve this secret value after you close the window.

Configure the Check Point Portal IdP:

1. In the Azure Portal, open your app. Click Overview and expand Essentials.

2. Copy the values of the Application (client) ID and Directory (tenant) ID.

3. In the Check Point Portal Identity Provider wizard, paste the values of Application (client) ID, Directory (tenant) ID, and Client Secret created in the previous step and click Next.

   

4. To test the users and group synchronization between the Check Point Portal and Identity Provider, click Test Connectivity.

   If the test is unsuccessful, repeat the Set Directory Integration step to configure the user and group synchronization parameters.

5. Click Next.

   Check Point validates access with the API key.

Prerequisites:

• In the Check Point Portal, create a user group with an Admin global role. See Users.

• You must have Administrator permissions for the IdP.

• You must have Active Directory and a premium P2 Azure subscription.

Step 1 - Configure the Directory Integration in the Check Point Portal:

1. In the Check Point Portal Identity Provider wizard, Set Directory Integration step, select Automatic Sync SCIM.

   

2. Copy and save the SCIM API Token and URL.

3. Click Next.

   The Confirm Identity Provider step opens.

4. Click Submit.

   Microsoft Entra ID is now integrated with the Check Point Portal. The Microsoft Entra ID integration appears in the gallery in the Check Point Portal. Finish configuring SCIM (Automatic Sync) in the Azure portal.

Step 2 - Configure the Application Integration in the Azure Portal:

1. In your Microsoft Azure account, navigate to Microsoft Entra ID.

2. From the left toolbar, click Enterprise Applications.

   The Enterprise Applications page opens to the Manage > All applications tab.

3. In the table, open the enterprise application you created for the Check Point Portal.

4. From the left menu, click Manage > Provisioning.

   The Provisioning page opens to the Overview tab.

5. For Provisioning Mode, select Automatic.

6. In the Admin Credentials section:

   1. In the Tenant URL field, enter the URL you copied from the Check Point Portal's Set Directory Integration step.

   2. In the Secret Token field, enter the SCIM API Token you copied from the Check Point Portal's Set Directory Integration step.

   3. Click Test Connection.

7. Click Save.

8. In the Mappings section, click Provision Microsoft Entra ID Directory Users.

9. On the Attribute Mapping page that opens:

   1. In the Target Object Actions section, make sure these checkboxes are selected: Create, Update, Delete.

   2. In the Attribute Mappings table, find the row with the externalId value in the customappsso Attribute column and click Edit.

      The Edit Attribute page opens.

   3. In the Source attribute field, select objectIdand click OK to close the Edit Attribute page.

   4. In the Attribute Mapping page, select Show advanced options.

   5. Click the Edit attribute list for customappsso option.

   6. On the Edit attribute list page, scroll down to add a new attribute with these values:

      • Name: urn:ietf:params:scim:schemas:extension:InfinityIdentityExtension:2.0:User:onPremSid

      • Type: String

   7. Click Save to close the attribute list editing.

   8. In the Attribute Mapping window, click Add New Mapping.

   9. In the Edit Attribute window, configure the mapping as shown in the image below and then click OK:

      • Source attribute: onPremisesSecurityIdentifier

      • Target attribute: urn:ietf:params:scim:schemas:extension:InfinityIdentityExtension:2.0:User:onPremSid

      

   10. Click Save and confirm.

10. From the top navigation toolbar, click [NAME OF APPLICATION]| Provisioning.

11. From the left menu, go to Manage > Users and groups.

12. Add users and groups.

13. From the left menu, click Overview.

14. Click Start provisioning.

    It can take up to a few hours for Azure to finish sending directory information to the Check Point Portal.