Microsoft SSO
Last updated
Last updated
The following steps describe the state of Microsoft services at the time of creating this instruction (16/01/2024). The Microsoft identity platform interface may change, so for the most up-to-date information, refer to the official source and their official video guide
To log in to the AppSec portal through your Microsoft identity platform, follow these steps:
Navigate to your Microsoft Entra using the link
Navigate to Application -> App registrations section and register a new application
You will see the following screen, where you need to copy the <Application (client) ID>:
Now create a client secret on the "Certificates & secrets" tab:
The final data you have to get here is the server metadata url.
Use the data created for your application to configure SSO integration in the AppSec portal:
Domain: login.microsoftonline.com
Client ID: <Application (client) ID>
Client Secret: <Value>
Server metadata url: <OpenID Connect metadata document>
To create a role mapping in our portal, follow these steps:
Create custom roles for Application
Navigate to Applications -> App registrations -> <Created application> -> App roles section and create all required roles here
Now you will be able to assign users/groups to Application roles
For example select a group with all colleagues from IT department and assign them to our newly created role
Configure the mapping of roles for your SSO connection. JSON key in JWT token with list of external groups field should equal to roles for this integration.
The integration only works with the roles value We know that Microsoft provides the guide with a clearly displayed "groups" key 🤷♂️ Get more information about this specific feature from the video
If a mapping has not been previously configured, the first time you log in using Single Sign-On (SSO), the SSO settings will display a list of roles received from Microsoft under the name External Group Name. You can configure these roles by creating mappings. To do this, add the corresponding portal roles for each group from this list.
If new roles appear on the Microsoft's side, they will also appear as unassociated during the first login and you should associate them later.
