Prerequisites and Permissions

Prerequisites

Azure Management

• Ensure that a client application has been registered on your Azure Management portal as a web application or web API, and you have access to the Client ID and Client Secret for this application.

• Configure at least one virtual appliance cluster and successfully test the connection. For instructions, refer to the Virtual Appliance Reference Guide.

• Use certificate based authentication in Exchange Online as basic authentication is deprecated by Microsoft. For more information, refer to Certificate Based Authentication in Exchange Online Management.

• You must install IQService to use this feature. For more information, refer to IQService.

  Important

  IQService installation now enforces TLS configuration by default to improve security and safeguard your environment. To proceed with the installation, ensure you have completed the necessary prerequisites for TLS configuration. For more information, refer to Configuring TLS and Client Authentication for IQService.

• For cloud management prerequisites and requirements, refer to Group Management for Azure Cloud Objects.

• To use Graph API, a client application must be registered on the Azure management portal. This application is responsible for calling Web APIs on behalf of the connector. The application's client ID and client secret key are required while configuring the application.

  To register an application on Azure, perform the following:

  1. Use either of these Azure management portals to do the configuration: https://portal.azure.com Or https://aad.portal.azure.com

  2. Select Microsoft Entra ID in the left pane.

  3. Select App registrations.

  4. Select New registration.

  5. On the Register an application page, in the Name field, enter the name of the application that you want to set up. For example, SailPointAzureADManagement.

  6. In the Supported account types, set up accounts based on users that are able to use that application or the API.

  7. (Optional) Set up the URL in Redirect URL, to have the successful response after authentication. You can use the following format: http://domainName/GraphWebapp

     Note

     The Microsoft Entra ID connector does not use the URL mentioned above, the above example is just a placeholder and does not impact functionality.

  8. Select Register. An application is created. On the Application page the Application (client) ID, and other details are displayed. Note down this ID.

  9. On the left-hand panel, select Certificates & secrets. On the Certificates & secrets page, in the Client secrets section, select New client secret.

  10. On the Add a client secret page, enter the Description to generate a secret, choose the validity duration in the Expires list. Select Add. Note down the value of the secret that you have just created.

Microsoft Entra

The required host values (https://<host>/) by the Microsoft Entra ID connector to interact with the managed system are as follows:

• https://graph.microsoft.com

• https://management.azure.com

• https://login.microsoftonline.com

  Note

  If you are using this option, refer to the Azure Government Endpoint Configuration topic for configuration details.

Creating OAuth 2.0 JWT Certificate Credentials

Use the following steps to create JWT certificate credentials for OAuth 2.0 authentication. For more information, refer to OAuth 2.0 Authentication.

Registering an Application and Assigning API Permissions

1. Register an application in Azure portal. For more information, refer to register an application in the Microsoft documentation.

   Note

   The linked document is not maintained by SailPoint and is subject to change without notice.

2. After you register the app, copy the Application (client) ID, and then generate a client secret.

3. Assign API permissions to the application. For the permissions this connector requires, refer to Required Permissions. For more information about assigning permissions, refer to API permissions in the Microsoft documentation.

   Note

   The linked document is not maintained by SailPoint and is subject to change without notice.

If you have already registered the application and assigned API permissions, continue with Creating and Using the Certificate.

Creating and Using the Certificate

1. Run PowerShell as an administrator on a Windows computer, and then generate a self-signed certificate with the following command:

   New-SelfSignedCertificate -DnsName "EntraID" -CertStoreLocation "cert:\LocalMachine\My"

2. Go to certlm.msc > Personal > Certificates, right-click the certificate, and select Export. Complete the Certificate Export Wizard and export the certificate in PFX format.

3. Select Include all certificates in the certification path if possible and Enable certificate privacy.

4. Enter a password to protect the private key, and use AES-256-SHA256 encryption. You need this password when you use the PFX file.

5. Save the PFX file to a directory of your choice. Download OpenSSL, or use Git Bash.

   Note

   The linked document is not maintained by SailPoint and is subject to change without notice.

   Copy the PFX file into the directory where the command prompt or terminal is open as an administrator. Run the following commands one at a time, and press Enter after each command. The file names are examples. You can use other file names if you use the same names in each command.

   1. openssl pkcs12 -in test1.pfx -nocerts -out sp.key

   2. openssl pkcs12 -in test1.pfx -clcerts -nokeys -out sp.crt

   3. openssl rsa -in sp.key -out rsasp.key -traditional

      Note

      The -traditional parameter is not always required. Whether you need it depends on the OpenSSL version.

6. Upload the sp.crt file to the Microsoft Entra app registration:

   1. Sign in to the Azure portal.
   2. In App registrations, select the client application.
   3. Select Certificates & secrets.
   4. Select Upload certificate, select the certificate file, and then select Add.

7. On the Connection Settings page, enter the text of rsasp.key in Private Key and the text of sp.crt in Certificate. For more information, refer to Connection Settings.

   Private Key Password is the passphrase you entered when you created sp.key.

Required Permissions

If you don’t want to provide granular permissions on each API, provide the following permissions on the entire directory to the client application created in Azure, which will enable the connector to perform read and write operations on users and groups (excluding deleting users and groups) :

• Directory.Read.All (Read Directory Data)
• Directory.ReadWrite.All (Read and Write Directory Data)

Assigning the Built-in Reader Role to the Application

To grant the built-in reader role to the application, follow these steps in the Microsoft Entra ID portal:

1. Go to Management groups.
2. Select the Tenant Root Group and open its Access control (IAM) settings.
3. Select Add, then choose Add role assignment from the dropdown menu.
4. Select the Reader(built-in) role from the list.
5. Go to the Members tab and select Select members.
6. Search for the application you created earlier and select it.
7. Select the Review and assign to finalize the role assignment.

Assigning Necessary Permissions to the Client Application

To grant the necessary permissions to the client application, follow these steps:

1. In the Microsoft Entra console, go to API permissions and select Add a permission.
2. On the Request API permissions page, select Microsoft Graph API from the list of APIs.
3. For the permission type, select Application permissions.
4. Under Select permissions, choose the permissions listed in the table below, and then select Add permissions.
5. Go to the Grant consent section and select Grant admin consent for your directory.
6. When the confirmation dialog appears, select Yes.

Granular Level Application Permission

• To perform Set Password and Delete user operations, an application created on Azure must have the User Administrator role.
• To manage users with administrative roles or users who are members/owners of role-assignable groups, an application created on Azure must have the User Administrator or Global Administrator role and the Privileged Authentication Administrator role.
• Use the Azure portal to assign the previously mentioned administrative roles. For more information, refer to Assign Microsoft Entra Roles to Users.

Additional API Permissions for CIEM

The following API permissions are necessary for SailPoint CIEM to include potential Azure cloud resource access derived from eligible membership in PIM groups:

• PrivilegedAccess.Read.AzureADGroup
• PrivilegedAssignmentSchedule.Read.AzureADGroup
• PrivilegedEligibilitySchedule.Read.AzureADGroup

The following table lists the required permission types and their purposes:

The following permission applies to SAML Bearer Assertion, Refresh Token / AuthCode, and JWT Certificate Credentials grant types:

The following permissions apply to Access Packages management:

The following permissions apply to Multi-Factor Authentication management:

The following permissions apply to User management:

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.