Configuring Azure Active Directory

1. Create a web application to allow Crowd to communicate with Azure AD:

1. Log in to your Azure Portal.
2. Go to Azure Active Directory > App registrations.
3. Create a new application registration with the following details:

• • Application type: Web (Option is available under Redirect URI sub-section)

  • Sign-on URL: <Crowd's base URL>
    
    

    Where can I find my Crowd's base URL?

    In Crowd, go to  > General, and check the value of Base URL.

After the application is created, note down the Application (client) ID assigned to it. You will need it later on to configure the integration in Crowd.

2. Configure permissions for the web application to allow Crowd to read data from Azure AD:

1. In your web application, click API permissions.
2. In the API permissions section, click Add a permission.
3. Under Microsoft APIs select Microsoft Graph, and select Application permissions for the type of permissions required for this application
4. Add the following permission from:
   
   • Directory.Read.All
5. Click Add Permissions and then, under Grant consent section, click Grant admin consent button.
6. Click Yes and confirm.

3. Create a key for the web application. Crowd will use this key to authenticate to Azure AD:

1. Click your web application.
2. In the Certificates & secrets section, click New client secret.

3. Choose a description and an expiry date for your key then save it. 

   Keep in mind that when the key expires and you don't replace it, Crowd will not be able to communicate with Azure AD.

4. Copy and store the key value.

   You will not be able to view it after navigating away from the key settings.

4. Create a native application that will be used by Crowd to validate user credentials:

1. Go to App registrations, and create a new application registration with the following details:

• • Type: Native (Option is available under Redirect URI sub-section)
  • Redirect URL: <Crowd's base URL>

Note down the Application ID assigned to it. You will need it later on to configure the integration in Crowd.

5. Configure permissions for the native application to allow Crowd to validate user credentials:

1. Click your native application.
2. Click API Permissions
3. Under Grant consent section, click Grant admin consent button.
4. Click Yes and confirm.

6. Configure manifest for the native application to allow Crowd to validate user credentials:

1. Click your native application.
2. Click Manifest
3. In the manifest editor, set the allowPublicClient property to true
4. In the bar above the manifest editor, click Save 

7. Get the Tenant ID to configure the integration in Crowd:

1. Go to the main Azure Active Directory blade.
2. Click Properties. 
   Note down the Directory ID - this is the Tenant ID you will need later on to configure the integration in Crowd.

 8. Add Azure AD to Crowd.

1. Log in to the Crowd Administration Console.
2. In the top navigation bar, click Directories. 
3. Click Add Directory, and then select Azure Active Directory as type.
4. Fill out the required fields.
   You will need to specify the Tenant ID, Web application ID, Web application key and Native application ID that you received when you configured Azure Active directory.
5. If you are integrating with an Azure Active DIrectory region that uses alternative API URLs (for example Azure Germany), you can pick the region from the Region drop-down.
   If your region is not listed, you can pick Custom, and enter the appropriate API URLs manually.
6. (optional) DATA CENTER ONLYIn the Group filtering section, instead of adding the whole user directory to Crowd, you can choose specific groups from Azure AD. Only members of these groups will be added to Crowd. 

7. (optional) Modify the default synchronization settings to match your needs.
   
   

   DATA CENTER ONLY If you check Enable group filtering and Enable nested groups checkboxes, the Synchronize group memberships when logging setting is automatically set to Never and can't be changed.

8. (optional) Click Test Connection to verify if data you entered is correct.