---
title: Azure SSO
description: "Please note, the following steps walk through an example use case and the information that will need to be saved will be specific to your application. ##### **Application Registration using Azure Portal** To setup Azure Single Sign-On with SecurEnds and…"
url: "https://www.securends.com/documentation/azure-sso/"
updated: "2025-02-27"
category: "Credential Entitlement Management (CEM) / Single Sign-On (SSO)"
---

# Azure SSO

Please note, the following steps walk through an example use case and the information that will need to be saved will be specific to your application.

##### **Application Registration using Azure Portal**

To setup Azure Single Sign-On with SecurEnds and Azure AD, you need to register SecurEnds as an application within the Azure portal. Doing this will create the service principal object in your Azure AD tenant.

The information that will need to be gathered and saved throughout the steps below are as follows:

- Tenant Id
- Client Secret (Value)
- Client Id
- Group Name
  - **Notice**: Desired group must be associated with the SSO application created

- How to Associate Azure Group to you SSO App in Azure portal:
  - Navigate to **Enterprise Applications**and search for the application
  - Click on Application name
  - In the Overview screen, click on **Assign users and groups**
  - Click on **Add user/group**
  - Here we can add either the user or the group to an application

##### **Step 1: Create Application**

- Login in to [https://portal.azure.com](https://portal.azure.com/)
- Navigate to left navigation menu and select **Azure Active Directory**

![](https://www.securends.com/wp-content/uploads/2021/09/image-80.png)

- Make note of the **Tenant ID** displayed on the right as this will need to be supplied to the SecurEnds team. After making note, select **Enterprise applications**

![](https://www.securends.com/wp-content/uploads/2021/09/image-82.png)

- Select **New application**. Be sure you have appropriate access. Admin permission is needed to create new application.

![](https://www.securends.com/wp-content/uploads/2021/09/image-84.png)

Select **Non**-**gallery application**

![](https://www.securends.com/wp-content/uploads/2021/09/image-85.png)

- Give an application name and select **Add**

![](https://www.securends.com/wp-content/uploads/2021/09/image-86.png)

- After creating an application, you will be automatically navigated to the application overview page
  - Make note of the **Application ID** and **Object ID** displayed on the screen as these will need to be supplied to the SecurEnds team
  - After making note, select **Single sign-on** on the left navigation menu

![](https://www.securends.com/wp-content/uploads/2021/09/image-87.png)

- Select **Linked** as the single sign-on method

![](https://www.securends.com/wp-content/uploads/2021/09/image-88.png)

- Provide the **Sign on URL** and select **Save**

![](https://www.securends.com/wp-content/uploads/2021/09/image-89.png)

- Navigate to home page > select **Azure active directory** > then select **App registrations**

![](https://www.securends.com/wp-content/uploads/2021/09/image-90.png)

- Select the application just created

![](https://www.securends.com/wp-content/uploads/2021/09/image-91.png)

- Select **Certificates and secrets**

![](https://www.securends.com/wp-content/uploads/2021/09/image-93.png)

- Select **New client secret**

![](https://www.securends.com/wp-content/uploads/2021/09/image-94.png)

- Add a **Description** and select a **Expires** timeframe. Once complete select **Add**

![](https://www.securends.com/wp-content/uploads/2021/09/image-95.png)

- The Client Secret will be displayed when these settings are saved and compulsory, copy the key to the clipboard, once you leave the page the key will not be visible
  - Make note of the **Client Secret** **(Value)**displayed on the screen as this will need to be supplied to the SecurEnds team

![](https://www.securends.com/wp-content/uploads/2021/09/image-96.png)

##### **Step 2: Azure Permissions**

After registering SecurEnds as an application within the Azure portal, the next step is to make sure the application has the correct API permissions to access data within Microsoft Graph. To do this the user or administrator must grant the correct permissions via a consent process.

- Select the **Authentication** link on the left navigation menu and select **Add a platform**

![](https://www.securends.com/wp-content/uploads/2021/09/image-97.png)

- Select **Web** as the configure platform under web applications

![](https://www.securends.com/wp-content/uploads/2021/09/image-98.png)

- Select "Add a platform" and input Redirect URL as below:
- https://companyname.securends.com/login/oauth2/code/azure
- **Configure**
- No need to add Logout URL since we are using REST API for logout

![](https://www.securends.com/wp-content/uploads/2021/09/image-99.png)

Under Logout URL in **Implicit Grant**, **ID token** checkbox should be enabled

![](https://www.securends.com/wp-content/uploads/2022/05/doc-id-token.png)

- Select **API permissions** on the left navigation menu and select **Add a permission**

![](https://www.securends.com/wp-content/uploads/2021/09/image-100.png)

- Select **Microsoft Graph** under Commonly used MicrosoftAPIs

![](https://www.securends.com/wp-content/uploads/2021/09/image-101.png)

- Under **Microsoft Graph** give the following **Delegated** Permissions. Totaling 4 permissions in all.

![](https://www.securends.com/wp-content/uploads/2021/09/image-102.png)

- Delegated permissions:
  - Email
  - Openid
  - Profile
  - Directory
- Search for **Directory** Permissions and Select **Directory.AccessAsUser.All** permission.

![](https://www.securends.com/wp-content/uploads/2021/09/image-104.png)

- Select **email, openid and profile**permissions as shown below

![](https://www.securends.com/wp-content/uploads/2021/09/image-105.png)

- Select **Add permissions** and then select **Grant admin consent for ********”

![](https://www.securends.com/wp-content/uploads/2021/09/image-106.png)

- Select **Yes**

![](https://www.securends.com/wp-content/uploads/2021/09/image-107.png)

- After selecting required permissions check the status for granted/not granted
  - Admin will get an option to grant those permissions beside "Add a permission button"

![](https://www.securends.com/wp-content/uploads/2022/05/doc-api-permission.png)

##### **Step 3: Manifest Configuration**

- Select the “Manifest” link on the left navigation menu and update the following:
  - oauth2AllowImplicitFlow value to **true**

![](https://www.securends.com/wp-content/uploads/2021/09/image-109.png)

##### **Step 4: Users and Groups Creation (Optional)**

If users and groups **HAVE** already been created, perform the following actions:

- Assign the existing **Group** being used to the **Application/SSO**
- Make note of "**Group Name**" as this info needs to be relayed to the SecurEnds team

If users and groups **HAVE NOT**been created, perform the following actions to create them:

- Create users and groups (**If already created then ignore this step**)
- Navigate to Azure Active Directory and select **Users**

![](https://www.securends.com/wp-content/uploads/2021/09/image-110.png)

- Select **New User** and add the appropriate details
- Navigate to Azure Active Directory and select **Groups**

![](https://www.securends.com/wp-content/uploads/2021/09/image-111.png)

- Select **New Group**and add the appropriate users to that group
  - This group contains a list of Active Directory groups to use for authorization
  - Make note of this **Group Name** as it will need to be supplied to the SecurEnds team

##### **Step 5: Configuration Settings**

Once the steps above have been completed then you can provide SecurEnds the following information that was saved based on the directions from each step

- Tenant Id
  - Contains your Active Directory's **Directory ID**from earlier
- Client Id
  - Contains the **Application ID**from your app registration that you completed earlier
- Client Secret
  - Contains the **Value**from your app registration key that you completed earlier
- Group Name
  - Contains a list of Active Directory groups to use for authorization

##### **Step 6: Update Azure Claim Token**

Required if your company utilizes two logins like UPN (**UserPrincipalName**) and email. Please go through the below steps to update Azure email claim token.

- Select the “**App registration**” link on the left navigation menu.

![](https://www.securends.com/wp-content/uploads/2021/09/image-5.png)

- Go to **All Applications** tab and click on the application for which looking to update an email token.
  - Example : securends-sharepoint as shown in the below screen.

![](https://www.securends.com/wp-content/uploads/2021/09/image-6.png)

- Once you have clicked on the Selected application the screen will redirect to the below.
- Select **Token Configuration** link on the left navigation menu.
- Click on **Add optional claim,**a new screen appears on the left side to Add optional claim.
- Select **Token type** as **ID**and **Claim**as **email**.
- Click on **Add**button.

![](https://www.securends.com/wp-content/uploads/2021/09/image-7.png)

Successfully, email claim token is updated.