Microsoft Azure and Active Directory (AD) Integration Setup
Last updated
Was this helpful?
Last updated
Was this helpful?
BalkanID recommends creating a separate service account for the purposes of this integration, instead of using personal or employee named accounts.
Application (client) ID
BalkanID Secret Key
Directory (tenant) ID
Note: The organization should posses an Azure AD Premium P1/P2 license and assign it to the user responsible for setting up the configuration. It is recommended for this user to have the Global Administrator Role.
Within your Azure portal, from the Dashboard search and navigate to App Registrations.
Click New Registration.
Fill in the details to register the application as mentioned in the screenshot.
Copy the Application (client) ID and Directory (tenant) ID after app registration. You will need these values to configure Azure within BalkanID.
Within your Azure portal, navigate to API Permissions and select Add a permission. Select Microsoft Graph.
Within Microsoft Graph section, you will see a choice between Delegated or Application permissions. Select Application permissions.
As shown in the screenshots below:
From the RoleManagement section, select RoleManagement.Read.All
From the AuditLog section, select AuditLog.Read.All.
From the AdministrativeUnit section, select AdministrativeUnit.Read.All.
From the Application section, select Application.Read.All.
From the Directory section, select Directory.Read.All.
From the Group section, select Group.Read.All.
From the User section, select User.Read.All.
Click Grant admin consent.. link for whatever permissions were assigned recently in the above steps (in example below, the directory is named “Default Directory”) as shown in the screenshot below.
Once granted, you will see status of each permission change from Not granted for your directory to Granted for your directory. The final list of permissions should match what is shown below.
Navigate to Certificates & secrets. Select New client secret. For description, use “BalkanID Secret Key”. For expiration, select your preferred expiration. Please note that you will need to reissue and update the client secret once this secret expires.
Copy the Value of the newly created BalkanID Secret Key. You will need this value to configure Azure within BalkanID. CAUTION: Please note that the entire Value may not be visible. You should use the copy to clipboard action next to the Value field to copy the entire value.
Login to the BalkanID application and switch to the tenant you would like to add your integration to.
Head to Integrations > Third Party Applications and click Add Integration, select Azure. Set up the Primary Application owner and the Description, if any.
Microsoft Azure would have been added to the list of applications. Click on the Configure and Integrate button beside the integration name, and configure the fields with the values that were noted prior. It should look like this:
Once you filled in the information, click Save changes. Your integration is now configured and you will see the status of the integration displayed alongside other integrations on the Integrations page. Integrations are synced daily. When data is available, the integration Status column will read Connected and the integration Message will read Data available.
Read Only (Access Review) Scopes
Lifecycle Management Scopes
RoleManagement.Read.All
RoleManagement.ReadWrite.Directory
AuditLog.Read.All
AuditLog.Read.All
AdministrativeUnit.Read.All
AdministrativeUnit.ReadWrite.All
Application.Read.All
Application.ReadWrite.All
Directory.Read.All
Directory.ReadWrite.All
Group.Read.All
Group.ReadWrite.All
User.Read
User.ReadWrite.All
User.Read.All
IdentityRiskEvent.Read.All
User-LifeCycleInfo.ReadWrite.All
(This scope is required only for pulling HRIS data from Azure, specifically to retrieve the termination date of an employee.)
