How to Set Up Azure AD Provisioning

Step 1: Set up Azure Provisioning with the senhasegura

Access the senhasegura and go to Settings > Provisioning > Identity Management (IGA) > Providers and click the Add button.

Configure with any name and description, but it must be in the SCIM Protocol and with Third-party users with NO.

In the Authentication section, enter the API access configuration where the Token for SCIM use will be obtained. The Authentication method needs to be OAuth 2.0.

After saving the item, it will appear in the Providers menu list. Click the Actions button and select Provider details. The Register Identity Management Provider screen will be displayed.

The base URL on the screen is used for configuration in Azure Provisioning. The Token URL on the screen is for obtaining the authorization token, as well as the Client ID and Client Secret. To obtain the authorization token, the Postman app can be used or the following CURL:

Short time token

As senhasegura uses OAuth and is not yet in the gallery apps that are supported by Microsoft, your token is valid only for one hour. Please repeat the process after the designated time.

Step 2: Create an Application in Azure AD

To use Azure Provisioning, it is necessary to create an application in Azure AD in Enterprise Application. When creating it, select "Create your own application" in the Azure AD Gallery;

And then select "Integrate any other application you don't find in the gallery (Non-gallery)". An application will be created and shown on the list.

Then just access the application and go to "Provisioning" in the menu.

Step 3: Configure Provisioning in Azure AD

To configure Provisioning, the URL obtained in the SCIM Provider created in the senhasegura and also the authorization token generated by Postman will be used.

After entering the information, test the connection. Mappings will then be released, where the fields of Groups and Users passed by Azure to the senhasegura will be defined. Currently, Azure cannot map the schemas used by SCIM on the senhasegura side, so it is necessary to manually configure it.

In Provision Azure Active Directory Groups, it will be configured as follows;

Enabled - yes
Target Object Actions
- Create - checked
- Update - checked
- Delete - checked
Azure Active Directory Attribute
- displayName
- objectld
- members
- displayName

The "accessGroup" attribute in the customappsso column does not exist in Azure AD, so it is necessary to create it by going to "Show advanced options" in the section below in "Edit attribute list for customappsso". Inside "Edit Attribute List," define it with the rules below:

Name	Primary Key?	Required?	Multi-Value	Exact case?
id	yes	yes	no	no
externalld	no	no	no	no
displayName	no	yes	no	no
members	no	no	yes	no
accessGroup	no	no	no	no

After editing the attributes, go back to the associated attributes screen and click Add New Mapping and, inside "Edit Attribute," add according to the configuration below:

Mapping type: Direct
Source attribute: displayName
Target attribute: accessGroup
Match objects using this attribute: No
Apply this mapping: Always

After that, just save the settings and go back to the Provisioning configuration screen (where the connection was tested).

Now the user fields must be defined by accessing "Provision Azure Active Directory Users". The same process of associating new fields will be performed here.

After adding all the fields, save and go back to the Provisioning configuration screen, where the connection is tested.

A last option will be enabled, which can be configured as desired.

After that, toggle to use "ON" in "Provisioning Status."

To Provision users and groups, they must be associated with the provisioning, on the main screen in "User and groups" of Azure.

Click on Add user/group and select the desired Group/User.

In this window, there is also the "Role." This Role will be associated in senhasegura as the user's permission. The premise is that both have the same name.