Configuring SSO: Azure Active Directory

If you enable the Azure AD integration at the host level, as described on this page, you cannot enable it at the organization/tenant level.

The integration at the host level only enables SSO. But if enabled at the organization/tenant level, the integration allows for SSO, but also for directory search and automatic user provisioning.

Step 1. Create an Azure AD App Registration

Note: The below steps are a broad description of a sample configuration. For more detailed instructions, see the Microsoft documentation for configuring Azure AD as an authentication provider.

Log in to the Azure portal as an administrator.
Go to App Registrations, and click New Registration.
In the Register an application page, fill in the Name field with a name for your Orchestrator instance.
In the Supported account types section, select Accounts in this organizational directory only.
Set the Redirect URI by selecting Web from the drop-down list and filling in the URL of your Orchestrator instance, plus the suffix /identity/azure-signin-oidc. For example, https://baseURL/identity/azure-signin-oidc.
At the bottom, select the ID tokens checkbox.
Click Register to create the app registration for Orchestrator.
Save the Application (Client) ID to use it later.

Step 2. Configure Azure AD SSO

Log in to the Management portal as a system administrator.
Go to Users and select the Security Settings tab.
In the External Providers section, click Configure under Azure AD.
- Select the Enabled checkbox.
- If you want to only allow logging in to Orchestrator using AzureAD, select the Force automatic login using this provider checkbox.
- Fill in the Display Name field with the label you want to use for the AzureAD button on the Login page.
- In the Client ID field, paste the value of the Application (Client) ID obtained from the Azure portal.
- (Optional) In the Client Secret field, paste the value obtained from the Azure portal.
- Set the Authority parameter to one of the following values:
  - https://login.microsoftonline.com/<tenant>, where <tenant> is the tenant ID of the Azure AD tenant or a domain associated with this Azure AD tenant. Used only to sign in users of a specific organization.
  - https://login.microsoftonline.com/common. Used to sign in users with work and school accounts or personal Microsoft accounts.
- (Optional) In the Logout URL, paste the value obtained from the Azure portal.
Click Save to save the changes to the external identity provider settings.
Restart the IIS site. This is required after making any changes to External Providers.

Step 3. Allow Azure AD SSO for the Organization

Now that Orchestrator is integrated with Azure AD Sign-In, user accounts that have a valid Azure AD email address can use the Azure AD SSO option on the Login page to sign in to Orchestrator.

Each administrator must do this for their organization/tenant if they want to allow login with Azure AD SSO.