Skip to main content

Setup SSO & Graph API user sync

Set up an app in the MSFT Azure portal and grant permissions to facilitate Single Sign-On and user synch via the Microsoft Graph API.

Written by Tom Segers

Prerequisites

To register a new application you need an account on Azure with enough permissions within your organization.

Step 1 – Register an application in the Azure AD portal

#1 — Go to portal.azure.com and sign in to the Azure portal #2 — Select 'App registrations' in the side menu > Click 'New registration' on top

#3 — Provide the required app information and click 'Register' at the bottom of the page:
​

  1. Name: Enter a meaningful application name

  2. Supported account types: Select 'Accounts in this organizational directory only'

  3. Redirect URI: Select 'Web' and fill in the following redirect URI: https://spencerlogin.b2clogin.com/spencerlogin.onmicrosoft.com/oauth2/authresp

#4 — Share the Directory ID (orange) & Application ID (yellow) with Spencer
​

#5 -- Make sure to add the UPN as well:

  • going to App registrations

  • Then token configuration

  • Click on the button "Add optional claim"

  • Select ID

  • Select UPN and add claim

Step 2 – Add a certificate (for user sync)

🚨 This step is only required when setting up the user synchronization via the MS Graph API. #1 — Spencer will generate and share a certificate for you to upload to the Azure portal. Generating the certificate is done by the Spencer IT team.
​

#2 — Upload the certificate provided by Spencer


Step 3 – Create a client secret

#1 — Go to the app's overview page and select 'Certificates & secrets' in the sidebar menu.

#2 — Click the 'New client secret' button. Add a description and select the maximum expiry period. Important: It is important you keep the end date of the expiry period in a shared calendar and provide the info to your Spencer contact as well because Azure will not notify you when this expires. Click 'Add'.
​

#3 — Copy the client secret and share it with Spencer Important: You can only copy the client secret right after the initial creation. You will not be able to do this later.
​

Step 4 – Grant permissions

Grant the correct permissions Grant the following API permissions to the Spencer Azure application to sync users:
​

⚠️ If you are planning to use Security Groups, 2 additional Application permissions are required:

  • Group.Read.All

  • GroupMember.Read.All

That's all!

Now the only thing left to do is to define the field mapping, explained in detail on this page.

Did this answer your question?