Azure Active Directory integration beta program

Organizations that use Azure Active Directory user provisioning (Azure AD) for user management can integrate it with their StarLeaf account. Azure AD integration is an additional option on your StarLeaf Enterprise account.

On this page:

• Features
• Pre-requisites
• How to set up the integration
• Troubleshooting

Features

• Automatically synchronize new users from Azure AD to StarLeaf
• Automatically synchronize user updates from Azure AD to StarLeaf
• Automatically synchronize user deactivation from Azure AD to StarLeaf

Pre-requisites

• Azure edition Premium P1 or P2
• StarLeaf Enterprise subscription

How to set up the integration

1. Complete StarLeaf Portal configuration (described below).
2. Add StarLeaf in Azure AD (described below).

StarLeaf Portal configuration for Azure AD integration

Before you can configure StarLeaf provisioning in Azure AD, you need to know the Tenant URL and Secret Token.

1. Log in to portal.starleaf.com
2. Go to Integrations > Add integration.
3. Select Microsoft Azure Active Directory and select Apply.
   
4. You see the SCIM server URI and Access token:



5. Make a note of the SCIM base URL and Access token. You will need these when you configure Azure AD.

Add StarLeaf in Azure AD

1. Log in to the Azure portal https://portal.azure.com
2. Go to Azure Active Directory > Enterprise applications.
3. Select New application.
4. Select Non-gallery application.



5. Give the application a name and choose Add.

   

You see the Overview page of the StarLeaf application.


6. On the Overview page:
   1. Select Provisioning and set the Provisioning Mode to Automatic.
   2. Enter the SCIM base URL and Access token from the Portal into the Tenant URL and Secret Token fields respectively.
   3. Select Test Connection. This confirms that you have used the correct credentials.
   4. Select Save.

   

7. Set Provisioning Status to On.
8. In Mappings, select Synchronize Azure Active Directory Groups
9. Ensure that Enabled is set to ‘No’.
10. Select Save and close the page.
11. Select Synchronize Azure Active Directory Users to customappsso.
12. Ensure that Enabled is set to ‘Yes’.
13. Ensure that Target Object Actions (‘Create’, ‘Update’, and ‘Delete’) are all ticked.
14. Customize the mappings so that they are as follows:

    Azure AD attribute	Customapp attribute	matching precedence
    Compulsory attributes
    mailNickname	externalId	1
    userPrincipalName	username	2
    Not([IsSoftDeleted])	active
    userPrincipalName	emails[type eq “work”].value
    givenName	name.givenName
    surname	name.familyName
    displayName	name.formatted
    The following attributes are dependent on your AD configuration, but will include some of:
    mobile	phoneNumbers[type eq “mobile”]
    telephoneNumber	phoneNumbers[type eq “work”]
    preferredLanguage	preferredLanguage

15. Select Save.
16. Close the Attribute Mapping page and navigate back to Provisioning.
17. Ensure that Scope is set to ‘Sync only assigned users and groups’.
18. Ensure that the box is ticked where it says ‘Clear current state and synchronization’.



19. Select Save.

Users added in Azure AD take a minimum of 20 minutes to appear in the StarLeaf Portal. This may take longer if there are a lot of users / user groups.

If you add a user to Azure AD and this user already exists in the StarLeaf Portal with an identical email address, the user will be managed in Azure AD from that point on.

Troubleshooting

If you think your access token has been compromised, you must create a new token. In the StarLeaf Portal, go to the Azure Active Directory Integration and select Regenerate access token and select Apply. You must enter the new token in Azure AD as the Secret Token.