# External Identity Provider Configuration - Azure IDP

#### Service Provider Configuration

The page [here ](https://help.cymmetri.io/identity-hub/authentication/service-provider)shows how to configure a Service Provider.

#### Microsoft Entra Configuration

Now Login to the Microsoft Entra portal, <https://entra.microsoft.com/>

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FSgKWWu6Q2uPUwS2q50Sb%2Fimage.png?alt=media&#x26;token=632d8822-fb18-474b-ad59-58a5d695dea4" alt=""><figcaption></figcaption></figure>

Navigate to Enterprise applications and select New Application.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FmpuSByFkdo6WPtGqdsHG%2Fimage.png?alt=media&#x26;token=f826e363-802c-4f1c-9f8e-a9deb656370d" alt=""><figcaption></figcaption></figure>

Click on Create your own application, Enter the Application Name and click on the Create button.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FG3F1J7JdDsFuBIGXmTaC%2Fimage.png?alt=media&#x26;token=d9be2741-3570-4554-bf6d-493df62e9234" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FhY1t2cPqwJjwiTsDQpoH%2Fimage.png?alt=media&#x26;token=b5658be1-7ba0-4479-9f20-b9b36004769e" alt=""><figcaption></figcaption></figure>

Once the application is created click on the Single Sign On  menu and Set up Single Sign-On with SAML

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FMivE8y94KrU4RlDNYixD%2Fimage.png?alt=media&#x26;token=79689c72-b6e2-44b8-a3d6-60ab6000dc60" alt=""><figcaption></figcaption></figure>

Download a metadata file from Cymmetri- Service Provider page (how to create service provider is shown above)

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FpWG14jYi6xYxd39JMwHW%2Fimage.png?alt=media&#x26;token=03019b3e-f43e-4e0a-8ffb-d0d835a0623c" alt=""><figcaption></figcaption></figure>

Upload the downloaded metadata file here:

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FvQw2J6qSmXm7cS3kgPx0%2Fimage.png?alt=media&#x26;token=bda44bb4-bf67-41a8-a9a9-cd2caf4accab" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FUQ8qHusU5GQUFLU2KtD0%2Fimage.png?alt=media&#x26;token=a4d646eb-7df4-4fc3-846d-e802a1054f3c" alt=""><figcaption></figcaption></figure>

The Identifier (Entity ID) and Assertion Consumer Service URL from the XML file downloaded in  previous step are populated, then save the configuration.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FivFn2uIb0UqwPGYIORuv%2Fimage.png?alt=media&#x26;token=9e0e46d9-cd20-4111-95d3-afa2c1505369" alt=""><figcaption></figcaption></figure>

Download the Certificate (Base64) from SAML Certificates.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2F4whMX4VRKkJM5oIeNL5g%2Fimage.png?alt=media&#x26;token=78ee0d51-21f7-483f-9ddd-3adbce8daa80" alt=""><figcaption></figcaption></figure>

#### Assigning Users to the Application

Assigning users to applications in Microsoft Entra Enterprise Application that we just created to allow users to use Azure(Microsoft Entra) as an External Identity provider&#x20;

Navigate to Enterprise applications and select the application you created above

Go to Users and Groups, and select Add user/group and add the user.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2Fws3mw7QPPjV07TuugEKI%2Fimage.png?alt=media&#x26;token=8a7252fe-8075-4d08-b6af-478a4e88689a" alt=""><figcaption></figcaption></figure>

#### Cymmetri IDP Configuration

Navigate to External IDP in Identity Provider.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2F0EajLHB3cI5URQXGs6MH%2Fimage.png?alt=media&#x26;token=fdbbda64-bd1e-4b80-b521-03c71f7a5497" alt=""><figcaption></figcaption></figure>

Select Azure-IDP.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FYEf6Bl0q7etMwQ603KPk%2Fimage.png?alt=media&#x26;token=b64d9654-cdb6-4723-826c-1c168a20a781" alt=""><figcaption></figcaption></figure>

Configure Azure AD for Creating Identity provider configuration

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FjpWAgpNdpuXwdWULYoI9%2Fimage.png?alt=media&#x26;token=ac5c4ddd-7cbe-4b1f-8d6c-00a3dee7f25c" alt=""><figcaption></figcaption></figure>

Next, Continue the configuration of Identity Provider In Cymmetri Administration Console, copy Microsoft Entra Identifier from Set up,  navigate to azure-idp in Cymmetri, and paste it in Entity ID.&#x20;

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FM2B5rAuvZvpaTfbcd2Do%2Fimage.png?alt=media&#x26;token=c348be1a-83e8-4f8f-ad15-b1ef3bb6fc41" alt=""><figcaption></figcaption></figure>

Similarly, copy the login URL and paste it into the Single Sign On Service URL in Cymmetri.

Replace the text "\<host-name>" as the URL of the Cymmetri deployment (e.g., [https://aktestidp.ux.cymmetri.in](https://aktestidp.ux.cymmetri.in/) in the *destination* field - "https\://*\<hostName>*/spsamlsrvc/samlSP/SingleSignOnService"  as "<https://aktestidp.ux.cymmetri.in/>spsamlsrvc/samlSP/SingleSignOnService".

Open the Base64 certificate downloaded in step 12, copy it, and then paste it into the x509Certifcate field in Cymmetri.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2F6yMJ5DpQVBsluohB6xTz%2Fimage.png?alt=media&#x26;token=48032f15-fae6-47d8-acf3-4c597c827a87" alt=""><figcaption></figcaption></figure>

Select the created service provider in the Service Provider Id field dropdown and save the changes.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FtCWpQ2toKy7rkFNqRtYP%2Fimage.png?alt=media&#x26;token=1d38c8ad-798c-4f3c-bd28-eb1df0df4e35" alt=""><figcaption></figcaption></figure>

For enabling Azure IDP to be used as an IDP for a specific set of users an Authentication Rule needs to be configured. [Here ](https://help.cymmetri.io/identity-hub/authentication/authentication-rules)you can see the steps on how to configure Authentication Rules.

#### Configuring JIT provisioning in Cymmetri&#x20;

If JIT provisioning needs to be enabled for Azure AD(Microsoft Entra) as external Identity provider, we may set it up using the steps below.&#x20;

Navigate to JIT in external identity provider and enable JIT Configuration.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FIQUP3SSNp6xyXSguqlUI%2Fimage.png?alt=media&#x26;token=aa03c28e-21c5-4218-95c4-bba97d613de4" alt=""><figcaption></figcaption></figure>

The following fields are mandatory in Cymmetri - firstName, lastName, login, userType, displayName, and email.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2Fgqavtnxs8M8J2XmKQOUL%2Fimage.png?alt=media&#x26;token=bdafe4b7-2918-4c4d-ad7e-4d3d111970e9" alt=""><figcaption></figcaption></figure>

For Azure JIT configuration, the following mapping needs to be done -&#x20;

| Label            | Application Field                                                 | Cymmetri Field |
| ---------------- | ----------------------------------------------------------------- | -------------- |
| First Name       | <http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname> | firstName      |
| Last Name        | <http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname>   | lastName       |
| Login (Username) | <http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name>      | login          |
| User Type        | any string                                                        | userType       |
| Display Name     | <http://schemas.microsoft.com/identity/claims/displayname>        | displayName    |
| Email Address    | <http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name>      | email          |

#### Checking the Azure Authentication

Login to cymmetri using Azure Email Address

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FnxvVrKJHCMN33kL4sA1o%2Fimage.png?alt=media&#x26;token=6f716a5b-71a4-48fc-827e-9f0c58f24f88" alt=""><figcaption></figcaption></figure>

The user will be redirected to the Azure portal to enter the Azure credentials.

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FSBu43pXmNcLgYQKarChd%2Fimage.png?alt=media&#x26;token=aa7623ac-1d81-4368-8334-c4844efc5e10" alt=""><figcaption></figcaption></figure>

Once the credentials have been entered properly in the Azure portal, the user will be redirected back to Cymmetri and will be logged in successfully.&#x20;

<figure><img src="https://3609793515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiOkb5tnBpg4wioRhBnTB%2Fuploads%2FVqRB8w6JT8R8LQlt70OL%2Fimage.png?alt=media&#x26;token=f7168f51-f6b1-46c4-b09e-3e731a74dd6e" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://help.cymmetri.io/identity-hub/authentication/identity-provider/external-idp/external-identity-provider-configuration-azure-idp.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.