Setup Microsoft Entra ID (formerly Azure Active Directory)
In order for IBI-aws to communicate with a Microsoft Azure Active Directory, the following steps are required.
Before setting up Microsoft Azure Active Directory access, we recommend enabling certificate-based encryption of the configuration file.
This ensures that only authorized clients are granted access.
IBI-helpMe Admin (Part 1)
Generate certificate for client authentication
- Launch IBI-helpMe Admin
- Navigate to Azure Active Directory
Tenant ID
andApplication ID
can first be leaved blank- Under
Certificates
click onGenerate
- Click on
Export (Public Key Only)...
and save the public key of the certificate to a desired location. - Click on
Save
Azure Portal
Register application
- Open Azure Portal
- Navigate to
Azure Active Directory
> App registrations
- Click on
New registration
- Choose an appropriate name. E.g.
IBI-helpMe
- Select an appropriate account type (if in doubt, select
Accounts in this organizational directory only
) - Click on
Register
Setup certificate authentication
- Open Azure Portal
- Navigate to
Azure Active Directory
> App registrations
- Select the previously registered application
- Click on
Certificates & secrets
- Select the
Certificates
tab - Upload the previously saved certificate (Public Key) using
Upload certificate
Setup API permissions
In order for IBI-aws to query the required information, the following API permissions must be assigned:
Device.Read.All
User.Read.All
GroupMember.Read.All
These permissions are assigned as follows.
- Open Azure Portal
- Navigate to
Azure Active Directory
> App registrations
- Select the previously registered application
- Click on
API permissions
- Click on
Add a permission
- Select the
Microsoft APIs
tab - Select
Microsoft Graph
- Click on
Application permissions
- Select the above mentioned permissions using the search function.
- Confirm the operation by clicking on
Add permissions
- The
Admin consent
must be requested via the menu (...) of the respective permission
Dertermine Tenant ID and Application ID
- Open Azure Portal
- Navigate to
Azure Active Directory
> App registrations
- Select the previously registered application
- Note
Directory (tenant) ID
andApplication (client) ID
IBI-helpMe Admin (Part 2)
Finalize setup
Once the application has been registered in the Azure Portal and all permissions have been granted, the remaining information can be transferred in the IBI-helpMe Admin and a connection test can be performed.
- Launch IBI-helpMe Admin
- Navigate to
Azure Active Directory
Enter the previously noted information as follows:
Azure property IBI-aws property Directory (tenant) ID
Tenant ID
Application (client) ID
Application ID
Activate
the certificate- Click on
Test connection
to make sure that a connection and the authentication could be performed successfully - Click on
Save