Microsoft Entra ID (formerly Azure AD) (Enterprise Application)

You can enable users to log in using a Microsoft Entra ID (formerly Azure AD) account, either from your computer or from the external directory.

Registering Application through the Microsoft Azure Portal

1. Log in to your Microsoft Azure Portal.

2. Navigate to Azure Active Directory in the left pane.

   

3. Go to Manage > Enterprise applications.

   

4. Click New application.

   

5. Click Create your own application.

   

6. In the What's the name of your app filed, enter a name for your application.

   

   Note - Do not change the default setting.

7. Click Create.

   The Microsoft Azure application is created.

8. Browse to App registrations, locate and select your application.

9. Click Manage > Authentication > Add a platform.

   

   The Configure platforms window appears.

10. Select Web.

    

11. In the Redirect URI (Optional) field, select Web from the type of application list and enter https://workspace.perimeter81.com URI where the access token is sent to.

    

12. Click Configure.

13. In the Redirect URIs section, enter https:// auth.perimeter81.com/login/callback.

    

14. In the Front-channel logout URL section, enter https://{{WORKSPACE}}.perimeter.com where {{WORKSPACE}} refers to your Harmony SASE workspace name.

    

15. To allow access from external organizations, in the Supported account types section, select Accounts in any organizational directory (Any Azure AD directory - Multitenant).

    

16. Click Save.

Configuring the Permissions for the Application

To configure the permissions for the application:

1. Log in to your Microsoft Azure Portal.

2. Click Identity > Applications > App registrations > All applications.

3. Select your application.

4. Click Overview > Manage > API Permissions.

   

5. Click Add a permission.

   

   The Request API permissions page appears.

6. Click Microsoft APIs and select Microsoft Graph from the list of available APIs to change the access level.

   

7. Click Delegated permissions.

8. Select the User.Read and Directory.Read.All checkbox to modify the permissions so your application can read the directory..

   

   

9. Click Add permissions > Configured permissions > Grant admin consent for approval of your app API permissions.

10. Click Yes.

    Your application gets the granted permissions.

11. To enable user group support, enable:

    1. Application Permissions: Read directory data.

    2. Delegated permissions: Access the directory as the signed in user.

12. Click Save to save the changes.

13. To remove the Windows Azure Active Directory API permission, see Appendix A - Removing Microsoft Entra ID (formerly Azure AD) API Permissions.

Configuring the Key

1. Log in to your Microsoft Azure Portal.

2. Go to Identity > Applications > App registrations > All applications.

3. Browse to App registrations, locate and select your application.

4. Go to Manage > Certificates & secrets.

5. Click New client secret.

   

   The Add a Client secret window appears.

6. In the Description filed, enter a name for the key.

7. In the Expires field, select the expiry:

   • In 1 year

   • In 2 years

   • Never

   

8. Click Add.

   The new key is added.

9. To get the secret value of the key, go to the Client secrets tab and copy the secret Value.

   This value is the Client Secret in Harmony SASE Admin console. .

   Note - The Secret value of the key need to be copied before you close the screen. If not, you need to create a new key.

   

Configuring IDP Connection in Harmony SASE

1. Access the Harmony SASE Administrator Portal and click Settings > Identity Providers.

   The Identity Providers page appears.

   

2. Click Add Provider.

   The Add identity provider window appears.

   

3. Select Microsoft Azure AD.

4. Click Continue.

   The Microsoft Azure AD page appears.

   

5. In the Microsoft Azure AD Domain field, enter the domain name.

6. In the Domain Aliases field, enter the email ID(s) separated by commas or spaces.

7. In the Client ID field, enter the Application (client) ID in Microsoft Azure AD:

   1. Log in to your Microsoft Azure Portal.

   2. Go to Identity > Applications > App registrations > All applications.

   3. Browse to App registrations, locate and select your application.

   4. Go to Overview > Application (client) ID.

      

   5. Copy the Application (cient) ID value.

8. In the Client Secret field, enter the secret value. See step 9 in Configuring the Key.

   

9. In the Azure AD Edition, select either:

   1. PI

   2. P2

10. Click Done.

Assigning Users and Groups in Microsoft Azure

1. Log in to your Microsoft Azure Portal.

2. Navigate to Azure Active Directory in the left pane.

3. Go to Manage > Enterprise applications.

   

4. Search and select your application.

5. Go to Users and groups and click Add user/group.

   

6. Click None Selected in Users.

   

7. Search and select the user(s) or group(s) you want to add to the application.

   Note - Special characters are not supported in groups.

8. Click Select.

9. Click Assign.