Setting up SSO on Azure
Create Azure application
1. Login to https://portal.azure.com/#home
2. Go to Azure Active Directory > Enterprise applications
3. Click on New application to reach the App Gallery.
4. Click on Create your own application , input your application name & Click Create
5. You’ve successfully created the Application.
Setup SSO on Azure
1. Click on the Azure application created earlier. Click on Single sign-on tab & click on SAML section.
2. Copy the Callback URL from Dashboard Organization SSO Setting
3. Paste the copied Callback URL into Sign on URL
4. Copy the Service Provider Entity ID from Dashboard Organization SSO Setting
5. Paste the copied Service Provider Entity ID into Identifier (Entity ID) . Then click Save.
Test SSO Azure Application
To test your Azure SSO Application you need to assign a user in Azure, who is using the same email address as your Pigeonhole dashboard account, into this application.
1. At the application level, click on the Users and groups tab
2. Click on Add user/group
3. Click on None Selected link & select the user that want to provision at right hand tab & click select button.
4. Click Assign button. The user will be assigned to Pigeonlab SCIM Client application
Configure Dashboard SSO
1. Under application of Single sign on, download the Federation Metadata XML.
2. Upload the metadata to Dashboard Organization SSO. Make all the SAML settings fields are filled.
3. Click Test Configuration
4. Login to the Azure application with your Azure account assigned to this application
5. Click Apply new configuration
6. Enable both Organization Admins and All workspaces
7. Click Save button
Setting up SCIM on Azure
Enable SCIM on Dashboard
1. Under Organization → Settings → SCIM , enable the SCIM provisioning
2. Select the workspace license for provisioning and the transferee for deprovisioning.
3. Click Save button
4. Under Setup Info , click Generate Token
5. Copy the SCIM Bearer Token
Setup SCIM Client
1. Go to the Azure application created earlier. Click on Provisioning tab & Get started button
2. Choose the Provisioning Mode as Automatic. Put SCIM Base URL in the Tenant URL, and ensure that you add this path at the end /v1/scim/?aadOptscim062020 . Key in the Access Token generate from dashboard into the Secret Token field.
3. Click on Test Connection button & Save
4. Go to Provisioning tab and click Start provisioning. This is to ensure that the user assigned to this SCIM client application will be provisioned automatically.
Note: It can take up to 20-30mins to automatically update the provisioning for every user or action assigned to this application.
5. Click on Edit attribute mappings link
6. Click on Provision Azure Active Directory Users
7. It is recommended to only have the below attributes, and delete all other unrequired Azure Active Directory Attribute. Then click save button.
8. Click the close button
9. Click the save button again. This will successfully save the Provisioning setting
How To:
Create New User In Azure Active Directory
1. Go to Azure Active Directory & click Users tab
2. Create new user
3. Fill in the necessary field and click create button
Note: A new user created will take few seconds to reflect on the user list
Provisioning User
1. At the application level, click on the Users and groups tab
2. Click on Add user/group
3. Click on None Selected link & select the user for provisioning on the right hand tab & click select button.
4. Click Assign button. The user will be assigned to your created application
Note: It can take up to 20-30mins to automatically update the provisioning for every user or action assigned to this application. You can manually provision the user for faster provisioning.
5. Click on Provisioning tab and click on Provision on demand
6. Select the user & click Provision button. The user will be successfully provisioned.
Edit Profile
1. Go to Users and groups under the SCIM application created
2. Choose the user profile that you want to edit and click Edit button
3. After editing the profile, click Save button
4. Azure will automatically trigger SCIM endpoints to update the user’s profile in 20 - 30mins. Or you can manually trigger Provision on demand.
Deactivate Provisioned User
1. Go to Users and groups tab, tick the checkbox of the user that you want to deactivate. Then click Remove button.
2. Azure will automatically trigger SCIM endpoints to update the user’s profile in 20 - 30mins. Or you can manually trigger Provision on demand.
Reactivate Provisioned User
1. Go to Users and groups tab, click on the Add user/group button.
2. Click on the None Selected link, choose the user you want to reactivate back. Then click the Select button. Lastly click on the Assign button.
3. Azure will automatically trigger SCIM endpoints to update the user’s profile in 20 - 30mins. Or you can manually trigger Provision on demand.
Delete Provisioned User
1. Go to Default Directory All users tab, tick the checkbox of the user you want to delete. Then click on Delete button.
2. Go to Deleted users (preview) tab, tick the checkbox of user and click on Delete permanently button.
Note: if you do not manually delete a deleted user, the profile will be permanently deleted 30 days after they are deleted.