Fact

• PhenixID Identity Provisioning 4.0.0 or later

System Requirements

• Account in Microsoft Azure

Situation

Use PhenixID Identity Provisioning to setup automatic user provisioning to Azure Active Directory.

Solution

This document will show the steps that are necessary to configure Identity Provisioning to automatically provision (create/update/delete) information for Azure AD users and groups.

Download

Download the zip file:

extraactions.MicrosoftAzureAD-6.4.0.zip

For instruction of how to install the action package, read PSD1149.

Account settings

1. Sign in to the Azure Portal (https://portal.azure.com/).
2. Choose your Azure AD tenant by selecting your account in the top right corner of the page.
3. In the left-hand navigation pane, choose More Services, click App Registrations, and click New application registration.
4. Enter the following values:
   Name: PhenixID Identity Provisioning
   Application type: Web app / API
   Sign-on URL: http://signin.pip.se
5. Click Create.
6. The Application ID is to be used in the actions in parameter ‘Application Id’.
7. Mark the new application to make additional settings, and click on Keys.
8. Enter a name for the key: PhenixID IP Key.
9. Choose the duration for the key, and click on Save.
10. Copy the key value. It will not be available again after you leave this page. This key value is to be used in the actions in the parameter ‘Access Key’.
11. Click on Required permissions, click Add and click Select an API.
12. Choose the Microsoft Graph API.
13. Choose the Application Permissions Read and write directory data, Read and write all groups and Read and write all users’ full profiles.
14. Choose the Delegated Permissions Access directory as the signed in user.
15. Click on Select and Done.
16. Choose the Windows Azure Active Directory API.
17. Choose the Application Permissions Read and write directory data.
18. Choose the Delegated Permissions Sign in and read user profile, Access directory as the signed in user.
19. Click on Grant Permissions.
20. Wait some hours before testing the account.

Common Action Parameters

Multiple actions are included in the package, but they all have some parameters in common.

Actions for fetching objects from Azure and creating session objects

These actions will fetch all the objects from Azure and create one session object for each object in the result. The actions can typically be used in an Action Data Source.

Common Parameters

Azure Get All Users

Version 1.2

Available attributes

accountEnabled, businessPhones, city, country, department, displayName, givenName, id, jobTitle, mail, mailnickName, mobilePhone, officeLocation, onPremisesImmutableId, onPremisesLastSyncDateTime, onPremisesSecurityIdentifier, onPremisesSyncEnabled, passwordPolicies, postalCode, preferredLanguage, proxyAddresses, state, streetAddress, surname, usageLocation, userPrincipalName, userType

Azure Get All Groups

Version 1.2

Available attributes

allowExternalSenders, autoSubscribeNewMembers, createdDateTime, description, displayName, groupTypes, id, mail, mailEnabled, mailNickname, onPremisesLastSyncDateTime, onPremisesSecurityIdentifier, onPremisesSyncEnabled, proxyAddresses, securityEnabled, visibility

Actions for fetching additional attribute from Azure

These actions will fetch the configured attributes from Azure and add them to the existing session object.

Azure Add Data From User

Version 1.1

Available attributes

aboutMe, accountEnabled, birthday, businessPhones, city, country, department, displayName, givenName, hireDate, id, imAdresses, interests, jobTitle, mail, mailnickName, mobilePhone, mySite, officeLocation, onPremisesImmutableId, onPremisesLastSyncDateTime, onPremisesSecurityIdentifier, onPremisesSyncEnabled, passwordPolicies, pastProjects, postalCode, preferredLanguage, preferredName, proxyAddresses, responsibilities, schools, skills, state, streetAddress, surname, usageLocation, userPrincipalName, userType

Azure Add Data From Group

Version 1.1

Available attributes

allowExternalSenders, autoSubscribeNewMembers, createdDateTime, description, displayName, groupTypes, id, mail, mailEnabled, mailNickname, onPremisesLastSyncDateTime, onPremisesSecurityIdentifier, onPremisesSyncEnabled, proxyAddresses, securityEnabled, visibility

Actions for handling Users

A description of the attributes can be found here at Microsoft.

Other attributes

In order to use attributes that are not listed below, a special syntax can be used where you explicitly state the data type for the attribute:

In order to specify the data type, write an exclamation mark after the “Entra ID attribute”, and then the data type:

• string
• number
• boolean

For lists, add [] after, ex “string[]”

Example of “attributes to fetch”/”attributes to update”:

id,dn,surname,givenName,mail,otherMails!string[]|mails,faxNumber!string

In the example above:

• “otherMails!string[]|mails”:
  • Entra ID attribute: “otherMails”
    • Data type: string
    • “[]” – a list of strings
  • session attribute: “mails”
• “faxNumber!string”
  • Entra ID attribute: “faxNumbers”
  • Data type: string

onPremisesExtensionAttributes

Entra ID supports a fixed set of custom extension attributes that resides in the object onPremisesExtensionAttributes on an user object. They are named extensionAttribute1, extensionAttribute2, extensionAttribute3 etc – they are always strings, and are exposed as if they are located directly on the user object, for example:

extensionAttribute11|my-foo-bar-name

Azure Create User

Version 1.1

Mandatory single value attributes

accountEnabled, displayName, mailNickname, password, forceChangePasswordNextSignin, userPrincipalName

Optional single value attributes

businessPhones, city, country, department, givenName, jobTitle, mobilePhone, officeLocation, onPremisesImmutableId, passwordPolicies, postalCode, preferredLanguage, state, streetAddress, surname, usageLocation, userType

Azure Update User

Version 1.1

Optional single value attributes

accountEnabled, businessPhones, city, country, department,displayName, givenName, jobTitle, mailNickname, mobilePhone, password, forceChangePasswordNextSignin, officeLocation, onPremisesImmutableId, passwordPolicies, postalCode, preferredLanguage, state, streetAddress, surname, usageLocation, userType

Azure Delete User

Version 1.1

Actions for handling Managers

Azure Get Manager For User

Version 1.1

Available attributes

aboutMe, accountEnabled, birthday, businessPhones, city, country, department, displayName, givenName, hireDate, id, imAdresses, interests, jobTitle, mail, mailnickName, mobilePhone, mySite, officeLocation, onPremisesImmutableId, onPremisesLastSyncDateTime, onPremisesSecurityIdentifier, onPremisesSyncEnabled, passwordPolicies, pastProjects, postalCode, preferredLanguage, preferredName, proxyAddresses, responsibilities, schools, skills, state, streetAddress, surname, usageLocation, userPrincipalName, userType

Azure Update Manager for User

Version 1.1

Azure Get Direct Reports for User

Version 1.1

Actions for handling Groups

A description of the attributes can be found here at Microsoft.

Azure Create Group

Version 1.1

Mandatory single value attributes

displayName, mailEnabled, mailNickname, securityEnabled

Azure Update Group

Version 1.1

Optional single value attributes

allowExternalSenders, autoSubscribeNewMembers, description,displayName, mailEnabled, mailNickname, securityEnabled, visibility

Azure Delete Group

Version 1.1

Actions for Group Membership

Azure Get Group Members

Version 1.1

Azure Add User as Member in Group

Version 1.1

Azure Remove User as Member in Group

Version 1.1