Page Comparison

After you have published the EmpowerID SCIM microservice app to Azure, you need to return to Azure and do the following post-publishing steps:

• Turn on System-assigned managed identity for the App service

• Assign to the App service identity root level permissions to the App servicefor the Tenant Root Group

• Assign the App service to the Global Administrator role for the tenant

These steps ensure that EmpowerID has the appropriate authentication and access to read and write the user information for your Azure tenant.

Turn on System-assigned managed identity for the App Service

1. Log in to your Azure portal as an administrator and navigate to your App service.

2. Under Settings in the sidebar of the App service, click Identity.

3. On the Identity page, click the System assigned tab and , toggle Status to On and then click Save.

   Image Added

4. Click Yes when prompted to confirm that you want to enable system assigned managed identity.

   Image RemovedImage Added

5. Copy the Object ID. The Object ID is the ID of the service principal created when the System assigned managed identity feature is enabled. You need to

   Image Added

Next, assign to the App service

root level permissions to the

Tenant Root Group as shown below.

Assign

the

App service root level permissions

for the Tenant Root Group

1. In Azure navigate to Management groups.

2. Click the details link beside Tenant Root Group.

   Image RemovedImage Added

3. On the tenant root page, click Access Control (IAM) in the sidebar.

   Image RemovedImage Added

4. On the Access Control (IAM) page, click Add and then select Add role assignment.

   Image RemovedImage Added

5. In the Add role assignment pane that appears, click Select a role and then select Owner.

   Image RemovedImage Added

6. Search for and select the App service you deployed to the tenant.

   Image RemovedImage Added

7. Save the role assignment.

   Image RemovedImage Added

Assign the App Service to the Global Administrator role for the tenant

1. Navigate to Azure Active Directory.

2. In Azure Active Directory, select Roles and administrators (Preview) from the sidebar.

   Image RemovedImage Added

3. Enter Global administrator in the search field and then select the Global administrator role.

   Image RemovedImage Added

4. On the Global administrator | Assignments page, click Add assignments.

   Image RemovedImage Added

5. In the Add assignments pane that appears, search for the App Service and then click the tile for the service to select it.

   Image RemovedImage Added

6. Click Add.

   Image RemovedImage Added

The SCIM App service now has the global administrator role for the tenant. The next step is to connect EmpowerID to Azure AD.