Page Comparison

After you have published the EmpowerID SCIM microservice app to Azure, you need to return to Azure

and do the following post-publishing steps:

• Turn on System-assigned managed identity for the App service

• Assign to the App service identity root level permissions to the App service

• Assign the App service to the Global Administrator role for the tenant

These steps ensure that EmpowerID has the appropriate authentication and access to read and write the user information for your Azure tenant.

Turn on System-assigned managed identity for the App Service

1. Log in to your Azure portal as an administrator and navigate to your App service.

2. Under Settings in the sidebar of the App service, click Identity.

3. On the Azure navbar, click App registrations.

1. Image Added

2. On the Identity page, click the System assigned tab and toggle Status to On.

1. Image Added

2. Copy the Object ID. The Object ID is the ID of the service principal created when the System assigned managed identity feature is enabled. You need to assign to the service principal root level permissions to the App service as shown below.

Assign to the identity root level permissions to the App Service

1. In Azure navigate to Management groups.

2. Click the details link beside Tenant Root Group.

1. Image Added

2. On the tenant root page, click Access Control (IAM) in the sidebar.

1. Image Added

2. On the Access Control (IAM) page, click Add and then select Add role assignment.

1. Image Added

2. In the Add role assignment pane that appears, click Select a role and then select Owner.

1. Image Added

2. Search for and select the App service you deployed to the tenant.

1. Image Added

2. Save the role assignment.

1. Image Added

Assign the App Service to the Global Administrator role for the tenant

1. Navigate to Azure Active Directory.

2. In Azure Active Directory, select Roles and administrators (Preview) from the sidebar.

1. Image Added

2. Enter Global administrator in the search field and then select the Global administrator role.

1. Image Added

2. On the Global administrator | Assignments page, click Add assignments.

1. Image Added

2. In the Add assignments pane that appears, search for the App Service and then click the tile for the service to select it.

1. Image Added

2. Click Add.

1. Image Added

The SCIM App service now has the global administrator role for the tenant. The next step is to connect EmpowerID to Azure AD.