Configure Azure AD Auth for the SCIM App Service

Owned by Phillip Hanegan
Last updated: Jul 29, 2024
3 min read

The SCIM Microservice interfaces with EmpowerID and Azure to execute Azure AD operations in response to your actions in EmpowerID. For this to occur, the app service hosting the SCIM microservice needs to be configured so that it can authenticate to Azure AD and receive identity and access tokens with the necessary permissions to call the relevant Graph and Azure API endpoints on your behalf.

To configure Azure AD auth for the SCIM app service you will need to do the following:

  • Turn on app service authentication and enable Login with Azure Active Directory App

  • Select Azure Active Directory as the Identity Provider

  • Add the information you copied from service principal application you registered in Azure AD to the app service

  • Create a system assigned managed identity for the app service

 

Procedure

  1. Log in to your Azure portal as a user with the necessary permissions to configure the SCIM app service you created earlier.

  2. In Azure, navigate to the SCIM app service.

  3. On the navbar, under Settings, select Authentication (classic) and turn on App Service Authentication.

     

  4. Under Action to take when request is not authenticated, select Log in with Azure Active Directory.

  5. Under Authentication Providers, click Azure Active Directory.

  6. Under Management mode, select Advanced.

  7. Enter the following information for the Advanced mode settings:

    • Client ID – Enter the Client ID for the service principal you registered earlier for EmpowerID.

    • Issuer Url – Enter https://login.microsoftonline.com/<TenantID>, where <TenantID> is the TenantID of the application you registered in Azure AD for EmpowerID.

    • Client Secret – Enter the client secret for the application you registered in Azure AD for EmpowerID.

    • Allowed Token Audience – Enter the App Service URL.

      The settings should look similar to the below image:

       

  8. Click OK to close the Active Directory Authentication dialog.

  9. Back in the main Authentication / Authorization page, click Save.

     

  10. Under Settings, select Identity.

  11. Turn on system assigned managed identity and click Save.

     

  12. Copy the Object ID for the System assigned managed identity. You use this when you create and configure the API Management service for the SCIM VDS.

  13. Back in the Overview page for the App Service, click Get Publish Profile. You will need this file when you publish the SCIM Microservice to Azure.

     

    Â