Microsoft Entra ID Applications

This Client Assertion Application is used by 1E to perform directory searches in your IdP.  This allows a 1E Administrator to add users to the platform and give them assignments for roles and management groups.

1. In the Azure admin portal navigate to Microsoft Entra ID> App registrations > New registration.

   

2. On the Register an application screen, enter 1E Client Assertion as the name, then click Register.

   Although there are no strict requirements on the actual name, the application will be used by 1E for client assertion. All the other settings on the page can be left at their default values.

   

3. Select Certificates & secrets.

   

4. Select the Certificates tab, click Upload certificate.

   

5. Select the .pem file for the Client Assertion certificate sent to you by 1E and click Open.

   

6. Enter a description and click Add.

   

7. Once the certificate is added, click API Permissions.

   

8. Select Microsoft Graph and then Application permissions on the resulting popup.

   

9. Scroll down the list of permissions, expand GroupMember and add the following permissions.

   • GroupMember.Read.All
   • User.Read.All

   If these application permissions are not applied, you will not be able to add users to the 1E Platform. The Client assertion uses app permissions, there is no user as the authentication flow uses a certificate.

   

   

   The application also needs the delegated permission User.Read. This permission is granted by default and does not need to be changed.

10. Click on Grant admin consent for….

    

11. Confirm you wish to grant consent, you should see something similar to the following, with a green check next to the application entries.

    

This application is used to read the credentials for each account that logs into the 1E portal.

1. In the Azure admin portal navigate to Microsoft Entra ID > App registrations > New registration.

   

2. Type in the name 1E PKCE, although there are no strict requirements on the actual name, the application will be used by 1E to validate the user that is logging in.

   In the Redirect URI (optional) field type in your URI value.

   Make sure it is set to Single-page application (SPA) and enter the URI in this format:

   https://Your-companyFQDN>/Portal/api/Authentication/IdentityProviderRedirect then click Register.

   

   The Redirect field is case-sensitive. You MUST ensure that the case of the URL matches EXACTLY. This is an identity provider security feature. In other words, ‘tachyon’ instead of ‘Tachyon’ won’t work.

3. Select Authentication.

   

4. This application needs to have Allow public client flows set to disabled. Scroll down to the bottom, and make sure the slider to No and click Save.

   

5. Select API permissions.

   This application needs Microsoft Graph delegated API permissions of User.Read. This permission is granted by default and does not need changing. Click on Grant admin consent for….

   

   If these application permissions are not applied for the 1E PKCE app users will not be able to log in to the system. The 1E PKCE app uses delegated permissions as the User.Read.All permission relates to the user logging on.

6. Select Yes in the Grant admin consent confirmation popup.

   

7. To confirm admin consent has been granted, look for a green check in the Status column.

   

1. Select App registrations and choose New Registration.

   

2. Enter 1E Integrations for the name, then click Register.

   

   In the Overview menu make a note of the Application (client) ID, you will need to send this to your 1E Account Team as part of the overall provisioning process.

3. Select Certificates & secrets.

   

4. Select the Certificates tab and then click upload certificate.

   

5. Select the .cer file for the 1E Integrations certificate and click Open.

   

6. Enter a description and click Add.

   

7. You will then see a thumbprint of the certificate.

   

Once you have configured your applications, you will need to capture the following information and send it to your 1E Account Team.

• Tenant Metadata – this can be copied from Microsoft Entra ID > App registrations then selecting Endpoints.

  

  On the displayed panel on the right hand side of the screen, copy the value for OpenID Connect metadata document.

  

• Tenant ID – this can be copied from the Microsoft Entra ID Overview page.

  

• Application (client) ID - for your applications, you can copy these from the Overview menu of each application.

  

  A Microsoft Entra ID user account will be required. This account will be setup as the principal user during this installation of 1E. This account will need to populate all other users and groups in 1E Platform.

Information to send to 1E