Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

If you have deployed the EmpowerID Azure AD SCIM microservice to Azure and your organization integrates applications with Azure AD, you can manage those applications in EmpowerID

...

to include:

  • Creating and deleting applications

  • Assigning owners and deputies to applications

  • Creating application certificates and secrets

  • Creating application roles and scopes

  • Assigning users to application roles

...

  • Assign eligibility to applications to specify who can and cannot request access

  • Etc.

The workflow used to create Azure applications is the CreateAzureApplication workflow. This workflow has a number of parameters that you can configure to alter the fields that appear when onboarding Azure applications, as well as settings that determine whether human approval is required before EmpowerID fulfills the request and provisions the application in Azure. This article walks through the process for creating an Azure application and demonstrates the following:

  • Configuring the parameters of the CreateAzureApplication

  • Configuring the roles and ownership EmpowerID assigns to application owners and deputies

  • Specifying the approval process (human or automatic)

  • Running the workflow

  • Verifying the results

Easy html macro
theme{"label":"solarized_dark","value":"solarized_dark"}
contentByMode{"html":"<!doctype html>\r\n<link href=\"https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css\" rel=\"stylesheet\" integrity=\"sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC\" crossorigin=\"anonymous\">\r\n<link href=\"https://docs.empowerid.com/new_docs.css\" rel=\"stylesheet\">\r\n<script src=\"https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js\" integrity=\"sha384-MrcW6ZMFYlzcLA8Nl+NtUVF0sA7MsXsP1UyJoMp4YLEuNSfAP+JcXn/tWtIaxVXM\" crossorigin=\"anonymous\"></script>\r\n <div class = \"bd-callout bd-callout-info\">\r\n <h4>Prerequisites</h4>\r\n <p>To add an enterprise application to Azure, you need:</p>\r\n <ul>\r\n <li>An Azure AD tenant managed by EmpowerID</li>\r\n <li>One of the following Azure roles linked to the Service Principal EmpowerID uses to connect to Azure: Global Administrator, Cloud Application Administrator, or Application Administrator.</li>\r\n </ul>\r\n <p class = \"bd-callout bd-callout-success\">To run the <b>CreateAzureApplication</b> workflow,\r\n users must have the <b>UI-Res-Admin-MS-Application</b> Management Role.</p>\r\n </div>","javascript":"","css":""}

...

Onboard an Azure application

...

Navigate to the portal for the IT Shop in your environment.

...

Select Applications and click Onboard Azure Application.

...

...

The Create Azure Application wizard opens to assist you with onboarding an Azure application. Applications that you can integrate include Non-gallery Enterprise Applications (SAML), Gallery Enterprise Applications (SAML), and OIDC applications. In this example, OIDC application registration is being selected.

...

...

Select the Application Environment. It is recommended that you select an non-production environment for initial testing.

...

Select a tenant for the application.

...

Select a Location in EmpowerID. Default Organization is selected by default; if you wish to change this, click the link and then search for and select the desired location from the Location tree.

...

Click Next.

...

...

Give the application and Name and Description and then click Next.

...

...

Step 1: Configure workflow parameters

The workflow for onboarding Azure applications is CreateAzureApplication. The workflow has several parameters that affect field values. These parameters are listed in the below table. In this example, you set the DefaultAzureTenantID parameter to the Azure tenant where applications are to be created.

Parameter

Description

App_Auth_AssignmentRequired_IsVisible

Boolean value to determine whether the Assignment Required? checkbox is visible.

AppAuth_EnableUserSignIn_IsVisible

Boolean value to determine whether the Enabled for users to sign-in? checkbox is visible.

AppAuth_SupportedAccountType_IsVisible

AppExt_CAP_IsVisible

Boolean value to determine whether the Conditional Access Policy drop down is visible.

AppExt_ExtensionTab_IsVisible

Boolean to determine whether the Application Extension tab of the workflow is visible to users.

AppExt_ExtensionAttribute1_IsVisible

Boolean to determine whether the Application Extension Attribute 1 radio button option is visible. AppExt_ExtensionTab_IsVisible must be set to true for the radio button to be visible.

AppExt_ExtensionAttribute2_IsVisible

Boolean to determine whether the Application Extension Attribute 2 radio button option is visible. AppExt_ExtensionTab_IsVisible must be set to true for the radio button to be visible.

AppExt_ExtensionAttribute3_IsVisible

Boolean to determine whether the Application Extension Attribute 3 radio button option is visible. AppExt_ExtensionTab_IsVisible must be set to true for the radio button to be visible.

AppExt_ExtensionAttribute4_IsVisible

Boolean to determine whether the Application Extension Attribute 4 radio button option is visible. AppExt_ExtensionTab_IsVisible must be set to true for the radio button to be visible.

AppExt_ExtensionAttribute7_IsVisible

Boolean to determine whether the Application Extension Attribute 7 radio button option is visible. AppExt_ExtensionTab_IsVisible must be set to true for the radio button to be visible.

ApplicationLineListDataItemSetName

This specifies the AzureAppApplicationLine list data set of the various application lines that appear to users when selecting the environment for the application.

Default list items include those shown below:

Image Added

ApplicationType_Location_IsVisible

Boolean value that specifies whether the Select a location section of the workflow wizard form is visible to users. Set to true by default.

Image Added

ApplicationType_Location_SelectaLocation_IsVisible

If ApplicationType_Location_IsVisible is true, this Boolean value determines if the Select a Location tree is visible. Set to true by default.

ApplicationType_Location_Tenant_IsVisible

If ApplicationType_Location_IsVisible is true, this Boolean value determines if the Select a tenant drop-down is visible. Set to true by default.

DefaultAzureRBACManagerAppName

Specifies the default Azure RBAC Manager application used by EmpowerID to manage Azure RBAC resources. Set to EIDAzureRBACManager by default.

DefaultAssignmentRequired

Boolean value on the Azure service principal that determines if users and apps or services must first be assigned the application before accessing it. Set to true by default.

DefaultAzureTenantID

This is the GUID of the Azure tenant. If the value is present, the Select a Tenant drop-down will be auto filled with the specified tenant.

You can find the Tenant ID for your Azure tenant by navigating to
Azure RBAC Manager > Resources and selecting the Tenants tab.

Image Added

DefaultEmailMessageID

DefaultEnabledUsersSignIn

Boolean value on the Azure Service Principal that determines if assigned users will be able to sign in to this application, either from My Apps, the User access URL, or by navigating to the application URL directly.

DefaultOrgZoneID

Optional setting that specifies the Org Zone ID of the EmpowerID location that should be populated in the Select a Location tree drop-down.

DefaultSupportedAccountType

Default value that specifies the Microsoft accounts that are supported for the application.

ExtensionAttribute1ListDataItemSetName

Boolean to determine whether the Application Extension Attribute 1 radio button option is visible.

ExtensionAttribute2ListDataItemSetName

This points to the AzureAppExtensionAttribute2Choice list data set for displaying custom radio button options. The selected value is stored in the ExtensionAttribute2 attribute of the Protected Application in EmpowerID.

ExtensionAttribute3ListDataItemSetName

This points to the AzureAppExtensionAttribute3Choice list data set for displaying custom radio button options. The selected value is stored in the ExtensionAttribute3 attribute of the Protected Application in EmpowerID.

ExtensionAttribute4ListDataItemSetName

This points to the AzureAppExtensionAttribute4Choice list data set for displaying custom radio button options. The selected value is stored in the ExtensionAttribute4 attribute of the Protected Application in EmpowerID.

IntegrationTypeListDataItemSetName

This points to the AzureAppTypeOfIntegration list data set of the various Application Integration Types. By default, the list contains OIDC, SAML Gallery & SAML Non-Gallery options.

ListDataItemSetTypeName

Internal field for displaying list data items. Do not change the value.

NonGalleryTemplateID

Specifies the default template for creating non-gallery applications. Do not change the value.

ManagementRoleIDsToNotify

Specifies the ID of the Management Role whose members are to be notified each time an Azure application is created.

SupportedAccTypesOIDCListName

This points to the AzureAppSupportedAccountTypes list data set for displaying supported account type radio button options.

Default list items include those shown below:

Image Added

SupportedAccountTypesTemplateListName


To configure workflow parameters, do the following:

  1. On the navbar, expand Object Administration and select Workflows.

  2. Select the Workflow tab and search for Create Azure Application.

  3. Click the Display Name for the workflow.

    Image Added

     

  4. On the View One page for the workflow, expand the Request Workflow Parameters accordion and search for the DefaultAzureTenantID parameter.

    Image Added

     

  5. Click the edit button for the parameter, enter the appropriate Azure Tenant ID in the Value field and click Save.

    Image Added

     

  6. Configure any other settings as needed.

Step 2: Configure approval

The CreateAzureApplication workflow can be configured to allow the EmpowerID system to automatically provision an application in Azure when submitted by an authorized user or to require approval by one or more people before EmpowerID fulfills the request. The setting that determines whether approval is needed is the Do not generate a business request (no approval) setting. If enabled on the workflow, EmpowerID provisions the application without requiring approval; if deselected, EmpowerID generates a business request to create application an Azure application and routes the request for approval. Once approved, EmpowerID fulfills the request and provisions the application in Azure.

To configure whether approval is needed or not, do the following:

  1. Navigate to the View One page for the workflow (as shown in Step 1 above) and click the Edit (blue star) link to put the workflow in Edit mode.

    Image Added

  2. On the Edit One page, toggle Do not generate a business request (no approval) as needed and save your changes.

    Image Added

Step 3: Configure owner and deputy roles

Owner and deputy settings for Azure applications created in EmpowerID are determined by the Application Configuration settings of Azure RBAC Manager. These settings are listed in the below table.

Owner Settings

Description

AzureAppSingleOwnerCustomRole

AzLocalRole Name. This value determines the Custom Role assignment for the application owner in Azure. If value is empty, the user will be added as an Owner of the app registration in Azure. This user can view and edit the application registration.

AzureAppSingleOwnerAccessLevelID

Specifies the ID of the Access Level (ResourceTypeRole) that application owners should be granted. The default value is the Access Manager Access Level for the Azure application. The owner can assign or unassign any Access Levels for the resource directly by EmpowerID Location.

ProtectedAppSingleOwnerAccessLevelID

Specifies the ID of the Access Level (ResourceTypeRole) that protected application owners should be granted. The default value is the Access Manager for the protected application resource. The Access Manager is the owner of the resource and can manage/approve permissions assignments.

Deputy Settings

Description

AzureAppCustomRole1Name

This specifies the AzLocalRole name. This value determines the Custom Role assignment for ALL the deputies in Azure. If the value is empty, the deputies will be added as Owner(s) of the app registration in Azure. These user(s) can view and edit the application registration.

ProtectedAppMultiOwnerAccessLevelID

Specifies the ID of the Access Level (ResourceTypeRole) that deputies should be granted for the protected application resource in EmpowerID. Defaults to the ACT-Application-Object-Administration Access Level for the protected application resource. Deputies can perform create, update and delete operations on the protected application.

AzureAppMultiOwnerAccessLevelID

Specifies the ID of the Access Level (ResourceTypeRole) that deputies should be granted for the Azure application. Defaults to the ACT-Azure-Application-Administration Access Level for the Azure Application. Deputies can perform create, update and delete operations on the Azure application.

To configure custom owner and deputy role settings, do the following:

  1. On the navbar, expand Apps and Authentication and select Applications.

  2. From the Applications tab, search for RBAC and then click the Display Name link for Azure RBAC Manager.

    Image Added


    This directs you to the View One page for the application. From this page, you can manage the application as needed.

    Image Added

  3. On the View One page, select the App Resources tab and then expand the Application Configuration Settings accordion.

  4. Click the Edit (blue star) button for any setting you need to configure with a custom value.

    Image Added

  5. Save your changes.

Step 4: Run the workflow

  1. Navigate to the portal for the Resource Admin app in your environment.

  2. In Resource Admin, select Applications and then select the Workflows tab.

    Image Added

  3. Click Onboard Azure Application.

    Image Added


    This opens the Create Azure Application wizard workflow. Follow the wizard and fill in the fields of each section of the workflow with the appropriate information for your application.

    Image Added



    Insert excerpt
    IL:Azure App
    IL:Azure App
    nameCreateAzureAppWF-Screen1
    nopaneltrue

  4. Review the summary information for the application and then click Submit.

    If you configured the workflow to require approval, you should that a business request for the Azure application was successfully created. The business request must be approved by each designated approver before EmpowerID fulfills the request and creates the application.

    Image Added

  5. Click Submit to exit the wizard.

    Insert excerpt
    IL:External Stylesheet
    IL:External Stylesheet
    nopaneltrue

Step 5: If configured: Approve the Business Request

If the workflow was configured to require approval, do the following to approve the business request; otherwise, move to Step 6 below and verify the application in Azure.

  1. Navigate to the portal for the My Tasks application and log in as a user who can approve the request.

  2. In My Tasks, locate the Business Request for creating the application and click the Pending button.

    Image Added

  3. Click Run Workflow.

    Image Added

  4. Review the information in the Running Approval Workflow dialog and click Approve.

    Image Added


    You should see the request is completed and pending fulfillment, which occurs when the system creates the application in Azure.

    Image Added

Step 6: Verify the application in Azure

After the request to create an Azure application has been approved and EmpowerID has fulfilled the request, you should be able to confirm the application has been created in Azure with the owner and deputies specified when the application was created.

  1. Log in to your Azure portal and navigate to Azure AD > Enterprise applications.

  2. Select All Applications as the Application type and then search for the application you just created.

    You should see the application.

  3. Click the Name link for the application to navigate to the Overview blade for the app.

  4. Under Manage, click Owners.

    You should seethe Application owner and any deputies you specified for the application when you created it in EmpowerID.

Div
stylefloat:left; position:fixed;
idarticleNav

IN THIS ARTICLE

Table of Contents
maxLevel4
minLevel2
stylenone
printablefalse