If you have deployed the EmpowerID Azure AD SCIM microservice to Azure and your organization integrates applications with Azure AD, you can manage those applications in EmpowerID to include:
Creating and deleting applications
Assigning owners and deputies to applications
Creating application certificates and secrets
Creating application roles and scopes
Assigning users to application roles
Assign eligibility to applications to specify who can and cannot request access
Etc.
The workflow used to create Azure applications is the CreateAzureApplication workflow. This workflow has a number of parameters that you can configure to alter the fields that appear when onboarding Azure applications, as well as settings that determine whether human approval is required before EmpowerID fulfills the request and provisions the application in Azure. This article walks through the process for creating an Azure application and demonstrates the following:
Configuring the parameters of the CreateAzureApplication
Configuring the roles and ownership EmpowerID assigns to application owners and deputies
Specifying the approval process (human or automatic)
Running the workflow
Verifying the results
| Easy html macro | ||||
|---|---|---|---|---|
| ||||
Step 1: Configure workflow parameters
The workflow for onboarding Azure applications is CreateAzureApplication. The workflow has several parameters that affect field values. These parameters are listed in the below table. In this example, you set the DefaultAzureTenantID parameter to the Azure tenant where applications are to be created.
| Excerpt | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
To configure workflow parameters, do the following:
On the navbar, expand Object Administration and select Workflows.
Select the Workflow tab and search for Create Azure Application.
Click the Display Name for the workflow.
On the View One page for the workflow, expand the Request Workflow Parameters accordion and search for the DefaultAzureTenantID parameter.
Click the edit button for the parameter, enter the appropriate Azure Tenant ID in the Value field and click Save.
Configure any other settings as needed.
Step 2: Configure approval
The CreateAzureApplication workflow can be configured to allow the EmpowerID system to automatically provision an application in Azure when submitted by an authorized user or to require approval by one or more people before EmpowerID fulfills the request. The setting that determines whether approval is needed is enables EmpowerID to either automatically provision Azure applications or require approval. This is determined by the Do not generate a business request (no approval) setting. If enabled on the workflow, EmpowerID provisions the application without requiring approval; if deselected, EmpowerID generates is provisioned instantly. If not, a business request to create application an Azure application and routes the request for the application creation is generated and sent for approval. Once approvedUpon approval, EmpowerID fulfills the request and provisions the application in Azure.
To configure whether approval is needed or not, do the following:
Navigate to the View One page for the workflow (as shown in Step 1 above) and click the Edit
link to put the workflow in Edit mode.
On the Edit One page, toggle Do not generate a business request (no approval) as needed and save your changes.
Step 3: Configure owner and deputy roles
Owner The Application Configuration settings of Azure RBAC Manager determine owner and deputy settings for Azure applications created in EmpowerID are determined by the Application Configuration settings of Azure RBAC Manager. These settings are listed in the below table.
Owner Settings | Description |
|---|---|
AzureAppSingleOwnerCustomRole | AzLocalRole Name. This value determines the Custom Role assignment for the application owner in Azure. If value is empty, the user will be added as an Owner of the app registration in Azure. This user can view and edit the application registration. |
AzureAppSingleOwnerAccessLevelID | Specifies the ID of the Access Level (ResourceTypeRole) that application owners should be granted. The default value is the Access Manager Access Level for the Azure application. The owner can assign or unassign any Access Levels for the resource directly by EmpowerID Location. |
ProtectedAppSingleOwnerAccessLevelID | Specifies the ID of the Access Level (ResourceTypeRole) that protected application owners should be granted. The default value is the Access Manager for the protected application resource. The Access Manager is the owner of the resource and can manage/approve permissions assignments. |
Deputy Settings | Description |
AzureAppCustomRole1Name | This specifies the AzLocalRole name. This value determines the Custom Role assignment for ALL the deputies in Azure. If the value is empty, the deputies will be added as Owner(s) of the app registration in Azure. These user(s) can view and edit the application registration. |
ProtectedAppMultiOwnerAccessLevelID | Specifies the ID of the Access Level (ResourceTypeRole) that deputies should be granted for the protected application resource in EmpowerID. Defaults to the ACT-Application-Object-Administration Access Level for the protected application resource. Deputies can perform create, update and delete operations on the protected application. |
AzureAppMultiOwnerAccessLevelID | Specifies the ID of the Access Level (ResourceTypeRole) that deputies should be granted for the Azure application. Defaults to the ACT-Azure-Application-Administration Access Level for the Azure Application. Deputies can perform create, update and delete operations on the Azure application. |
To configure custom owner and deputy role settings, do the following:
On the navbar, expand Apps and Authentication and select Applications.
From the Applications tab, search for RBAC and
click the Display Name link for Azure RBAC Manager.
This directs you to the View One page for the application. From this page, you can manage the application as needed.
On the View One page, select the App Resources tab and then expand the Application Configuration Settings accordion.
Click the Edit
button for any setting you need to configure with a custom value.
Save your changes.
Step 4: Run the workflow
Navigate to the portal for the Resource Admin app in your environment.
In Resource Admin, select Applications and then select the Workflows tab.
Click Onboard Azure Application.
This opens the Create Azure Application wizard workflow. Follow the wizard and fill in the fields of each section of the workflow with the appropriate information for your application.
Insert excerpt IL:Azure App IL:Azure App name CreateAzureAppWF-Screen1 nopanel true Review the summary information for the application and then click Submit.
If you configured the workflow to require approval, you should see that a business request for the Azure application was successfully created.
Each designated approver must approve the business request
before EmpowerID fulfills the request and creates the application.
Click Submit to exit the wizard.
Insert excerpt IL:External Stylesheet IL:External Stylesheet nopanel true
Step 5: If configured: Approve the Business Request
If the workflow was configured to require approval, do the following to approve the business request; otherwise, move to Step 6 below and verify the application in Azure.
Navigate to the portal for the My Tasks application and log in as a user who can approve the request.
In My Tasks, select To Do and locate the Business Request for creating the application
.
Click the Pending button.
Click Run Workflow.
Review the information in the Running Approval Workflow dialog and click Approve.
You should see the request is completed and pending fulfillment, which occurs when the system creates the application in Azure.
Step 6: Verify the application in Azure
After the request to create an Azure application has been approved and EmpowerID has fulfilled the request, you should be able to confirm the application has been created in Azure with the owner and deputies specified when the application was created.
Log in to your Azure portal and navigate to Azure AD > Enterprise applications.
Select All Applications as the Application type and then search for the application you just created.
You should see the application.
Click the Name link for the application to navigate to the Overview blade for the app.
Under Manage, click Owners.
You should
see the Application owner and any deputies you specified for the application when you created it in EmpowerID.
| Div | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||
IN THIS ARTICLE
|