Skip to main content

Azure Active Directory

Connector name

agtazure

Connector type

Executable

Type (UI field value)

Azure Active Directory

Connector status / support

Bravura Security-Verified

This connector has been tested and is fully supported by Bravura Security.

Upgrade notes

The connector for Microsoft Office 365 Online Service, agtoffice365, was merged into agtazure in Connector Pack 4.1.0.

The following Bravura Security Fabric operations are supported by the agtazure connector (depending on your product license and version):

  • get server information

  • user change password

  • reset and expire password

  • check password expiry

  • administrator reset password

  • create account

  • delete account

  • disable account

  • enable account

  • create group

  • update group

  • delete group

  • add user to group

  • delete user from group

  • add group to group

  • remove group from group

  • add owner(user) to group

  • remove owner(user) from group

  • check account enabled

  • update attributes

  • List:

    • accounts

    • attributes

    • groups

    • members

    • roles

For a full list and explanation of each connector operation, see Connector operations.

Preparation

Before Bravura Security Fabric can perform operations in Microsoft Azure Active Directory, you must:

Setting up a target system administrator

Bravura Security Fabric uses a designated account on Microsoft Azure Active Directory to perform Bravura Security Fabric operations.

Create an app registration in Azure

  1. Log into the Microsoft Azure Active Directory portal.

  2. On the Azure Active Directory main page, under Manage click App registrations.

  3. Click New registration at the top of the screen.

  4. Enter a value for the Name field.

  5. Choose a value for Supported account type such as the default value of "Accounts in this organization directory only".

  6. Click Register.

Set the secret of the application (client) ID

  1. From the Azure Active Directory main page, go to the App Registrations page then choose the app configured earlier in Create an app registration in Azure .

  2. Under Manage, click on Certificates and Secrets.

  3. Click New client secret.

  4. Enter a value for the Description field.

  5. Choose a duration for when the client secret expires.

  6. Click Add.

  7. Take note of the value for the client secret as this will be the target administrator’s password.

  8. On the page for the new application, click Overview.

  9. Take note of the value for the Application (client) ID as this will be the target administrator’s username.

Set up permissions

  1. From the Azure Active Directory main page, go to the App Registrations page then choose the app configured earlier.

  2. Under Manage click on API permissions.

  3. Click Add a permission.

  4. Click Microsoft Graph.

  5. Click Delegated permissions.

  6. Search then add the following permissions:

    • User.Read

    • User.Read.All

    • User.ReadBasic.All

    • User.ReadWrite

    • User.ReadWrite.all

    After adding the permissions a warning may appear under the Status column in the API Permissions page specifying Not granted for ..... These warnings should be addressed when executing Step 9.

  7. Click Application Permissions.

  8. Search then add the User.ReadWrite.all permission.

  9. In the API Permissions page, click the button to Grant admin consent for .... then click Yes to confirm.

Expose an API

  1. From the Azure Active Directory main page, go to the App Registrations page then choose the app configured earlier.

  2. Under Manage click Expose an API.

  3. Click Set next to Application ID URI.

  4. If necessary, edit the value for Application ID URI, then click Save.

  5. Click Add a scope.

  6. Enter a value for the Scope name field.

  7. Set Who can consent? to "Admins and users".

  8. Enter a value for the Admin consent display name and Admin consent description fields.

  9. Click Add scope.

Creating a template account

Bravura Security Fabric uses template accounts as models or "blueprints" for creating new accounts in Microsoft Azure Active Directory. The following example illustrates how you can create a template account in Microsoft Azure Active Directory:

  1. Log into the Microsoft Azure Active Directory portal.

  2. On the Azure Active Directory main page, click Users.

  3. Click New user at the top of the screen.

  4. Enter a value for the "User name", "Name", "First name", and "Last name" fields.

  5. If needed, change the value for "Roles" to another directory role.

  6. Click Create.

  7. Click Reset password to assign a temporary password for the user.

    You can disable the account if it is to be used only as a template account or enabled later. You can do this by clicking user under the Users tab, and selecting Block for Allow the user to sign in and access services?.

Targeting the Microsoft Azure Active Directory system

For each Microsoft Azure Active Directory system, add a target system in Bravura Security Fabric (Manage the system >Resources >Target systems):

  • Type is Azure Active Directory, listed under "Network Operating Systems" in the drop-down list.

  • Address is formed using the options listed in the table below.

  • The Administrator ID and Password for the target system administrator are the client ID and key generated in Setting up a target system administrator .

  • Check the checkbox for Target system supports multiple owners on groups to allow for multiple owners for the Microsoft Azure Active Directory groups.

    Note

    Microsoft Azure Active Directory requires that a group have at least one owner. If a group already has an owner assigned and you wish to replace them with a new owner, this should be done in separate requests: add a new owner, then remove the previous owner.

The full list of target parameters is explained in Target System Options.

Table 1. Azure Active Directory address configuration

Option

Description

Options marked with a redstar.png are required.

Server

graph.microsoft.com

(key: server)

Port

443

(key: port)

Connection over SSL

Select to enforce SSL connections. Default is "true".

(key: ssl)

Validate the server’s certificate when connecting

Determines whether to validate the server’s security certificate for SSL connections. Default is "true".

(key: checkCert)

HTTP Network Proxy

Specifies a proxy URL to use for connecting.

(key: proxy)

Domain redstar.png

The FQDN of the Azure domain.

(key: domain)

Oauth2 Authentication server address

login.microsoftonline.com

(key: authsvr)

Oauth2 Authentication port

443

(key: authport)

Include external (guest) accounts

Select to list external accounts.

(key: listexternal)

List roles as groups

This option is to be able to also list Azure roles for the managed groups. The account group memberships are based on the "Active assignments" list for the Azure role.

(key: listRoleAsGroup)

List Cloud groups only

Select to only list cloud groups.

(key: cloudgrouponly)

Poll time after create

Time in seconds, the product server will check the Azure server for a new account creation.

(key: polltime)

Connector fail on invalid user

If the server does not find the new account within the poll time, a message will appear in the system log: user creation in Azure failed, please re-try later.

(key: failOnInvalidUser)

Custom search expression for filtering users(ignored when listGroups specified)

Restrict user listing by using the search filters .

(key: userFilter)

Groups to list users from

Restrict user listing from the specified groups, using the group name.

(key: listGroups)

Http header settings

Set this as part of the advanced query parameters for Microsoft Entra ID objects. This is also used in combination with the Custom search expression for filtering users option.

(key: headersettings)



User search filters

You can restrict user listing by using the search filters.

Custom search expression for filtering users

Navigate to the Target system address configuration page and enter a valid search filter expression in the Custom search expression for filtering users field.

Examples:

  • startsWith(displayName, 'M')

  • not(startsWith(displayName, 'M'))&$count=true

  • endsWith(userPrincipalName, '.com')&$count=true

  • not(endsWith(userPrincipalName, '.com'))&$count=true

The userFilter parameter should follow Microsoft’s graph API requirement: https://docs.microsoft.com/en-us/graph/query-parameters#filter-parameter

Advanced filters

If you use anything other than startsWith in your search, it is considered an advanced filter, and additional parameters and settings are required:

  • $count=true must be appended for the search filter

  • The Http header settings option must be set to ConsistencyLevel:eventual

Below is a working example of an advanced filter configuration:

agtazure - filter example.png

See more on advanced search queries (Implemented in Connector Pack 4.3): https://docs.microsoft.com/en-us/graph/aad-advanced-queries?tabs=http

Groups to list users from

Example:

  • Administrators; Sales

Custom search expression for filtering users is superseded when both this option and Groups to list users from are specified.

Handling account attributes

You can view the complete list of attributes that Bravura Security Fabric can manage, including native and pseudo-attributes, using the Manage the system (PSA) module. To do this, select Azure Active Directory from the Manage the system > Resources > Account attributes > Target system type menu.

For information about the native Microsoft Azure Active Directory attributes managed by Bravura Security Fabric , consult your Microsoft Azure Active Directory documentation.

  • DisplayName The account attribute is required to create new users in Azure Active Directory.

    To allow users to create new accounts:

    1. Add a profile and request attribute to provide a place to prompt the user for the display name.

    2. Ensure that you set read/write permissions to the attribute.

    3. Map the newly created profile and request attribute to the displayName account attribute. To learn how to do this, see the "Base Configuration Guide".

  • Licenses A read-only attribute which retrieves licensed products and service plans from accounts. The attribute contains product licensing information in format like following:

    Licenses =

{AAD_PREMIUM_P2={EXCHANGE_S_FOUNDATION=PendingProvisioning;ADALLOM

_S_DISCOVERY=PendingInput;MFA_PREMIUM=Success;AAD_PREMIUM=Success;AAD_PREMIUM_P2=Disable

d;};}

    The service plan is listed in raw KVG format.

  • LIC_PLAN A pseudo attribute which is used to write licensing assignment to account on the target system. The attribute contains licensed product name and corresponding service plans in a product. By default, the service plan list is empty; it is set to {} , which enables all service plans in a licensed product.

    To enable all service plans under the AAD_PREMIUM_P2 package enter:

    AAD_PREMIUM_P2={};

    To only enable the MFA_PREMIUM service plan under the AAD_PREMIUM_P2 package add the following:

    AAD_PREMIUM_P2={MFA_PREMIUM};

    The AAD_PREMIUM_P2 entry relates to the Azure Active Directory Premium P2 MS product name and the MFA_PREMIUM entry is the service plan name. Refer to the Microsoft documentation for more descriptions of their products and service plans.

    Using the LIC_PLAN attribute

    In the scenario where you create an Office 365 user using the Azure connector, the connector will create an Azure account and assign an Exchange Office 365 license. If you remove the Office 365 account, both the Azure account and its assigned licenses are deleted.

    You can customize which license plan you want removed when an account is removed by using the LIC_PLAN attribute. The plan entered in the LIC_PLAN attribute will also be the plan that is removed.

    For example, if you want to remove the Exchange Office 365 license for a specific user when the Office 365 account is removed you would enter the following in the attribute field:

    EXCHANGESTANDARD={EXCHANGE_S_STANDARD;}

    The LIC_PLAN attribute can contain multi-values, where each of the specified values should bear the same form, and each is specifying the granular license for a specific package.

    For example, if you want to remove the Exchange Office 365 standard license and the Azure Active Directory Premium P2 license when the Office 365 account is removed, you would enter the following in the attribute field:

    "EXCHANGESTANDARD={};" "AAD_PREMIUM_P2={EXCHANGE_S_FOUNDATION;ADALLOM_S_DISCOVERY;MFA_PREMIUM;AAD_PREMIUM_P2;};"

    LIC_PLAN only updates licenses directly assigned to individual account, it can not update licenses assigned to account via groups or organization.

  • usageLocation The account attribute is required when updating licensed product for users. License assignment fails without usageLocation properly configured to corresponding location to the licensed product.

For more details on licensed product names and service plan identifiers, please check Microsoft document:

https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/licensing-service-plan-reference

Handling group attributes

You can view the complete list of attributes that Bravura Security Fabric can manage, including native and pseudo-attributes, using the Manage the system (PSA) module. To do this, select Azure Active Directory from the Manage the system > Resources > Group attributes > Target system type menu.

For information about the native Microsoft Azure Active Directory attributes managed by Bravura Security Fabric , consult your Microsoft Azure Active Directory documentation.

Troubleshooting

Test for DNS access

On all Windows targets, possible issues with "Failed to connect" can be traced to the failure of the operating system on which the target agent runs (application server or proxy), to resolve the name of the target, or of a domain controller on which to execute the agent operations.

To verify for failure to resolve domain controllers, run the following command on the target system:

nltest /DCLIST:domain.used.in.target.address

To check what domain controller a domain-joined system is communicating with at the moment, run the following command on the target system:

nltest /DSGETDC:domain.used.in.target.address

The latter can be used on a Bravura Security Fabric application server or proxy or even on a workstation from where a password change request the originates.

If the operating system fails to resolve the address of the target or find a domain controller, check with the relevant Windows or Active Directory administrators to set up correct DNS resolution (add trust between domains or DNS forwarding, or run required services on the affected domain controllers). The server on which Bravura Security Fabric 's connector runs asks its own (joined domain) DNS for information on the other domains, so DNS forwarding or trust between the domains must be configured.

In this section: