Azure Active Directory (AD) Login

Setup

1. Create an Enterprise Application

1. In Azure AD Portal click on Enterprise Applications.
   
2. Select 'New Application'
   
3. Select Create your own application
   
4. Add a name for the application that your users will recognise. E.g 'XMAP' or the internal name you use for this service
   
5. Select Integrate any other application you don't find in the gallery (Non-gallery)
   
6. Click Create
   

2. Configure the Enterprise Application

This is an optional step but recommended to ensure users are automatically assigned to the application

1. In 'Enterprise Applications' select the newly created application
   
2. Click Users and Groups
   
3. Add a User Group to the application. It's recommended to use a new group specifically for managing access to this application but you can assign any group, e.g your default tenant group if all users are allowed access.
   

3. Configure the App Registration

    3.1 Authentication

1. Navigate back to the Azure AD Portal and select 'App Registrations'
   
2. Select the new application (if it is not visible change the filters to show all applications)
   
3. Select Authentication
   
4. Select Add a Platform
   
5. Click Web
   
6. For Redirect URI:
   
1. https://xmap.cloud/xnode/login/azure/return
   
2. If you have a custom domain you should also add this as a second value, e.g https://my-org.xmap.cloud/xnode/login/azure/return
   
7. Enable 'ID Tokens' in Implicit Grant and Hybrid Flows
   

    3.2 Client Secret

1. Click Certificates and Secrets
   
2. Create a new Client Secret (see notes for important information)
   
3. Store the Secret Value in a temporary location
   

4. XMAP Configuration

1. Click the + button to create a new strategy.
   
2. On the right hand side, fill in the details:
   
1. Client ID - The Application/client ID of the registration in Azure
   
2. Authority URL - the URL used to initiate login with azure. This will be https://login.microsoftonline.com/{YOUR_TENANT_ID}
   
3. Client Secret Value - the value of the secret obtained in the previous step
   
4. Return URL - enter https://xmap.cloud/xnode/login/azure/return
   
5. Redirect URL - enter the URL your users access XMAP from, with no path (e.g https://mydomain.xmap.cloud). If you are not sure use https://xmap.cloud
   

NOTE: The first time you attempt to access the application you will need to login as an administrator to grant consent for XMAP to read basic information about users (email, profile, openid etc).

If you are currently logged in as the default administrator, testing the URL will log you out and into the account associated with your email address.

5. Add the app to Office 365 App Launcher (optional)

1. Navigate to the Azure AD portal and go to Enterprise Applications
   
2. Select the application
   
3. On the left hand side click 'Single Sign On'
   
4. Select the 'Linked' option for Single Sign On
   
5. Enter the Login URL as displayed in the XMAP admin panel.

Due to the way the Azure portal works it can take several hours for this change to propagate in the Azure system.

---

Notes

Troubleshooting

1. Create a group called 'XMAP Users' as a Dynamic Group
   
2. For the dynamic group rule, set it to include any groups you wish to include (or any other logic), e.g
   

user.memberOf -any (group.objectId -in ['GROUP_ID'])

1. Note that it can take up to 24 hours for the dynamic group to populate, though this usually happens within a few minutes.