Collections : Azure AD (Microsoft Graph)

[PradeepKadambar]

Contents
Azure AD : Application Azure AD : Identity Collector Azure AD : Account Collector Azure AD : Setup App Setup Admin Consent Setup OAuth2 Configuration with RSA IGL Token (Admin Consent) Configuration with RSA IGL

Identities	Accounts	Groups	App Roles	Entitlements
✔️	✔️	✔️	❌	❌

Overview

This Azure AD integration guide is based on the generic REST collector.

API reference guide Microsoft Graph REST API v1.0 

Azure AD : Application

Steps

1. Login to RSA Identity G&L console as System Administrator.
2. Navigate to Resources > Directories.
3. Click on Create Directory and select Other Directory.
4. Enter the details as shown below.

   

5. Click Finish.

Azure AD : Identity Collector

This section explains the process for configuring an identity collector for the Azure AD application. We will use the RSA IGL generic REST collector for this purpose.

Steps

1. Login to RSA Identity G&L console as System Administrator.
2. Navigate to Resources > Directories.
3. Click on Azure AD.
4. Navigate to Collectors tab and click on Create Identity Collector. Enter the details as shown below.

   

5. Click Next and enter the connection details.
   

   

6. If authentication type is OAuth2, refer to OAuth2 Configuration with RSA IGL section.
7. If authentication type is Token, refer to Token (Admin Consent) Configuration with RSA IGL section.
8. Click Next. On the Account Data page, enter the following configurations.
9. Click Next. In the Map Collector Attributes to User Attributes, map the collected account attributes.
10. Click Next.
11. Click Finish. Use the Test function to make sure the configurations are accurate.

Azure AD : Account Collector

This section explains the process for configuring an account collector for the Azure AD application. We will use the RSA IGL Generic REST collector for this purpose.

Steps

1. Login to RSA Identity G&L console as System Administrator.
2. Navigate to Resources > Directories.
3. Click on Azure AD.
4. Navigate to Collectors tab and click on Create Account Collector. Enter the details as shown below.

   

5. Click Next and enter the connection details.
   

   

6. If authentication type is OAuth2, refer to OAuth2 Configuration with RSA IGL section.
7. If authentication type is Token, refer to Token (Admin Consent) Configuration with RSA IGL section.
8. Click Next. Select the data types that the collector will be collecting from Azure AD
9. Click Next. On the Account Data page, enter the following configurations.
10. Click Next. On the Group Data page, enter the following configurations.
11. Click Next. On the Account Group Membership Data page, enter the following configurations.
12. Click Next. In the Map Collector Attributes to Account Attributes, map the collected account attributes.
13. Click Next. In the Map Collector Attributes to Account Mapping Attributes, map the user reference attribute.
14. Click Next. In the Map Collector Attributes to Group Attributes, map the collected group attributes.
15. Click Next. In the User Resolution Rules, map the user to account.
16. Click Next. In the Member Account Resolution Rules, map the target collector for group members.
17. Click Finish. Use the Test function to make sure the configurations are accurate.

---

Azure AD : Setup

This section explains the setup of credentials for the service account that will be used with RSA IGL ADC and EDC.

App Setup

Steps

1. Login to Azure portal Microsoft Azure 
2. Select Azure Active Directory
3. Note down the Tenant ID. This is required in the RSA IGL collector configuration.
4. Click on App Registrations.
   
5. Click on New Registration
6. Provide the details as shown below. Under Redirect URI, provide OAuth callback URL (https://IGL_HOST_NAME:8443/aveksa/oauth/callback) for RSA IGL.
7. Click Register.
8. Note down the Client ID. This is required in the RSA IGL collector configuration.
9. Click on View API Permissions.
10. Select Microsoft Graph.
11. Select Delegated Permissions.
12. Select the below permissions.
13. Click Add Permissions.
14. Click on Certificates & Secrets. Click on New Client Secret.
15. Set the Description and suitable expiration period for the client secret.
16. Click Add. Note down the Client Secret which will be displayed only once. This is required in the RSA IGL collector configuration.

Admin Consent Setup

Steps

1. Refer to Authorization and the Microsoft Graph Security API - Microsoft Graph | Microsoft Docs  for information on Admin consent.
2. Prepare the Admin Consent URL as shown below and send it to the O365 administrator to consent.

   Format:

   https://login.microsoftonline.com/common/adminconsent?client_id=<Application Id>&state=12345&redirect_uri=<Redirect URL>

   Example:
   https://login.microsoftonline.com/a6d53c2-0f80-4a2e-947e-2a6h324jg1b71/adminconsent?client_id=24fsdfb1-8b66-4ba9-8f21-a7casdf73b1&state=4534646&redirect_uri=https://igl.company.com:8443/aveksa/oauth/callback

3. Once the Admin clicks the URL, they must login and authorize.

OAuth2 Configuration with RSA IGL

This section explains the process of setting up RSA IGL ADC and EDC to acquire the OAuth2 token dynamically from Microsoft Graph.

Steps

1. Login to RSA Identity G&L console as System Administrator.
2. Create or Edit a generic REST ADC or EDC that will be using OAuth2 authentication.
3. On the Connection Details page, configure the following.
   • Client ID - The Application (client) ID.
   • Client Secret - The client secret.
   • Authentication URL - https://login.microsoftonline.com/YOUR_TENANT_ID/oauth2/v2.0/authorize
   • Access Token URL - https://login.microsoftonline.com/YOUR_TENANT_ID/oauth2/v2.0/token
   • Scope - openid offline_access
4. Click on Get OAuth 2.0 Access Token.
5. Click on Proceed For Authorization.
6. Login to Microsoft with the service account credentials.
7. The below message indicates that RSA IGL has successfully acquired a token.
8. Click Close.
9. Save the collector configuration & test.

Token (Admin Consent) Configuration with RSA IGL

This section explains the process of setting up RSA IGL ADC and EDC with token authentication from Microsoft Graph admin consent option.

Steps

1. Login to RSA Identity G&L console as System Administrator.
2. Create or Edit a generic REST ADC or EDC that will be using Token authentication.
3. On the Connection Details page, configure the following.

   Username	Client ID
   Password	Client Secret
   Request Body	grant_type=client_credentials&client_id=${TokenUsername}&client_secret=${TokenPassword}

   
4. Save the collector configuration & test.