Azure Active Directory (SCIM)

Registering Application through the Microsoft Azure Portal

1. Log in to your Microsoft Azure Portal.

2. Navigate to Azure Active Directory in the left pane.

   

3. Go to Manage > Enterprise applications.

   

4. Click New application.

   

5. Click Create your own application.

   

6. In the What's the name of your app filed, enter a name for your application.

   

   Note - Do not change the default setting.

7. Click Create.

   The Microsoft Azure application is created.

8. Browse to App registrations, locate and select your application.

9. Click Manage > Authentication > Add a platform.

   

   The Configure platforms window appears.

10. Select Web.

    

11. In the Redirect URI (Optional) field, select Web from the type of application list and enter https://workspace.perimeter81.com URI where the access token is sent to.

    

12. Click Configure.

13. In the Redirect URIs section, enter https:// auth.perimeter81.com/login/callback.

    

14. In the Front-channel logout URL section, enter https://{{WORKSPACE}}.perimeter.com where {{WORKSPACE}} refers to your Harmony SASE workspace name.

    

15. To allow access from external organizations, in the Supported account types section, select Accounts in any organizational directory (Any Azure AD directory - Multitenant).

    

16. Click Save.

Configuring the Permissions for the Application

To configure the permissions for the application:

1. Log in to your Microsoft Azure Portal.

2. Click Identity > Applications > App registrations > All applications.

3. Select your application.

4. Click Overview > Manage > API Permissions.

   

5. Click Add a permission.

   

   The Request API permissions page appears.

6. Click Microsoft APIs and select Microsoft Graph from the list of available APIs to change the access level.

   

7. Click Delegated permissions.

8. Select the User.Read and Directory.Read.All checkbox to modify the permissions so your application can read the directory..

   

   

9. Click Add permissions > Configured permissions > Grant admin consent for approval of your app API permissions.

10. Click Yes.

    Your application gets the granted permissions.

11. To enable user group support, enable:

    1. Application Permissions: Read directory data.

    2. Delegated permissions: Access the directory as the signed in user.

12. Click Save to save the changes.

13. To remove the Windows Azure Active Directory API permission, see Appendix A - Removing Microsoft Entra ID (formerly Azure AD) API Permissions.

Configuring the Key

1. Log in to your Microsoft Azure Portal.

2. Go to Identity > Applications > App registrations > All applications.

3. Browse to App registrations, locate and select your application.

4. Go to Manage > Certificates & secrets.

5. Click New client secret.

   

   The Add a Client secret window appears.

6. In the Description filed, enter a name for the key.

7. In the Expires field, select the expiry:

   • In 1 year

   • In 2 years

   • Never

   

8. Click Add.

   The new key is added.

9. To get the secret value of the key, go to the Client secrets tab and copy the secret Value.

   This value is the Client Secret in Harmony SASE Admin console. .

   Note - The Secret value of the key need to be copied before you close the screen. If not, you need to create a new key.

   

Configuring SCIM Integration within Harmony SASE Administrator Portal

1. Access the Harmony SASE Administrator Portal and click Settings > Identity Providers.

   The Identity Providers page appears.

   

2. Click Add Provider.

   The Add identity provider window appears.

   

3. Select Microsoft Azure AD.

4. Click Continue.

   The Microsoft Azure AD page appears.

   

5. In the Microsoft Azure AD Domain field, enter the domain name.

6. In the Domain Aliases field, enter the email ID(s) separated by commas or spaces.

7. In the Client ID field, enter the Application (client) ID in Microsoft Azure AD:

   1. Log in to your Microsoft Azure Portal.

   2. Go to Identity > Applications > App registrations > All applications.

   3. Browse to App registrations, locate and select your application.

   4. Go to Overview > Application (client) ID.

      

   5. Copy the Application (client) ID value.

8. In the Client Secret field, enter the secret value.

   

9. In the Azure AD Edition, select either:

   • PI

   • P2

10. Select the SCIM Integration checkbox to enable continuous sync through the SCIM protocol.

11. Click Done.

12. Click Turn On in the SCIM Integration section if you are editing an existing Azure configuration.

    

13. To get the tenant URL and secret token, click Settings in the SCIM Integration section.

    

14. Click Copy to copy the URL.

    

    This is the Tenant URL that is required when configuring SCIM Integration within Azure AD.

15. Click Generate Token.

    The secret token is generated.

16. Click Copy Token.

    

    This is the Secret Token that is required when configuring SCIM Integration within Azure AD.

17. Click Close.

Configuring SCIM Integration within Azure AD Management Portal

1. Log in to your Microsoft Azure Portal.

2. Navigate to Azure Active Directory in the left pane.

   

3. Go to Manage > Enterprise applications.

   

4. Search and select the enterprise application you created.

5. In the left navigation pane, go to Manage > Provisioning.

6. Click Getting Started.

   The Provisioning window appears.

   

7. In the Provisioning Mode list, select Automatic.

8. Expand Admin Credentials and enter these:

   1. Tenant URL, see step 14 in Configuring SCIM Intergration within Harmony SASE.

   2. Secret Token, see step 16 in Configuring SCIM Intergration within Harmony SASE.

9. Click Test Connection.

10. Expand Mappings.

11. Enable the Provision Azure Active Directory Groups toggle button.

12. Click Provision Azure Active Directory Users.

    The Attribute Mapping window appears.

13. In the Target Object Actions section, select the relevant actions.

    These actions will trig calls to the SCIM adapter.

14. Configure Attribute Mappings to match these configuration by deleting all the irrelevant fields and changing userPrincipalName:

    Azure Active Directory Attribute	customappsso Attribute	Matching Precedence
    userPrincipalName	emails[type eq “work”].value	1
    givenName	name.givenName
    surname	name.familyName
    Switch([IsSoftDeleted], , "False", "True", "True", "False")	active
    mail	userName

    Note - If the userPrincipalName and emails[type eq "work"].value do not match, map userName with mail.

15. To provision a user on demand, click Provision on demand tab.

    

    The Provision on demand window appears.

16. Search and select the user who you want to provision or update.

    

17. Click Provision.