Single Sign-On using Azure Active Directory

You can provide SSO and optional auto-provisioning of users based on your Azure active directory. This article includes:

• Setting up SSO
• Setting up Auto Provisioning
• Migrating to Azure

Setting up SSO

1. Login to Anodot as Admin.
2. Navigate to Settings > Authentication.
3. In the displayed screen, enable the Azure Active Directory option.
   
   
4. In Azure, do the following:
   1. Define an app.
   2. Fill in the Redirect URL from Anodot, and verify that the ID tokens checkbox is selected.
   3. Define a client secret.
5. In Anodot, fill in the Identity Provider Details from the app created:
   • Application (client) ID
   • Directory (tenant) ID
   • Client secret
     
     
6. Return to Azure, navigate to App Branding, and define the following:
   1. [Optional] Fill in the Homepage URL from Anodot Login URL to provide users with ease of access. 
   2. Use the Anodot logo attached here:
      
   3. Fill in the Terms of Use link: https://www.anodot.com/terms-of-use/
   4. Fill in the Privacy Policy link: https://www.anodot.com/privacy-policy/
      
      Note: The user’s email address in Azure (in the contact information section) must match the email used for that user in Anodot. This is relevant for users that were already defined in Anodot before configuring Azure SSO. 

Setting up Auto Provisioning

1. In Anodot, navigate to Settings > Authentication, and enable the Azure Active Directory option.
2. Ensure the Auto provision new users checkbox is selected.
3. In Azure, you can create the roles in one of two ways:
   1. Use the manifest supplied below.
   2. Or, create the app roles manually, as detailed below

Using the supplied manifest

Navigate to App Manifest > App Roles, and copy the roles text specified: 

“appRoles”: [
      {
            “allowedMemberTypes”: [                 
                “User”            
            ],
            “description”: “Read Only User”,
            “displayName”: “Read Only User”,            
            “id”: “d1c2ade8-98f8-45fd-aa4a-6d06b947c62f”,
            “isEnabled”: true,  
            “origin”: “Application”, 
            “value”: “customer-read-only”
        },         
        {
            “allowedMemberTypes”: [                 
                “User”             
            ],
            “description”: “General User”,      
            “displayName”: “User”,             
            “id”: “d1c2ade8-98f8-45fd-aa4a-6d06b947c66f”,            
            “isEnabled”: true,            
            “origin”: “Application”,             
            “value”: “customer-user”
        },        
        {
            “allowedMemberTypes”: [               
                “User”           
            ],
            “description”: “General Admin”,          
            “displayName”: “Admin”,            
            “id”: “d1c2ade8-98f8-45fd-aa4a-6d06b947c66e”,             
            “isEnabled”: true,             
            “origin”: “Application”,             
            “value”: “customer-admin”
        }     
  ]

Creating the roles manually

1. Follow the Azure documentation here to create app roles
2. Create the following roles:
   1. Read Only: Value = customer-read-only
   2. Users: Value = customer-user
   3. Admins: Value = customer-admin

After you have created the roles, follow the Azure documentation here to assign users and groups to the application roles.

Note

• Azure AD Premium customers can assign roles to groups or users
• Azure AD free customers can assign roles to users but not to groups.

Migrating to Azure

This section is relevant for:

• Existing customers.

• If you have users defined in Anodot, with streams, alerts, dashboards defined and owned by them.

• If you wish to move to SSO based on Azure, with minimal overhead work after the migration.