Set Up Microsoft Entra ID (Azure AD) Single Sign On (SSO)

This article walks through the steps required to use Microsoft Entra ID (Azure AD) as your Single Sign On (SSO) authentication method in Cloud Control Center.

Three main components are required to successfully configure SSO using Microsoft Entra ID.

1. Adding Elisity Cloud Control Center Application in Azure AD

2. Create and Assign User Roles

3. Configure Azure SSO with Cloud Control Center (Two Methods)

Cloud Control Center supports up to 10 SSO providers. To connect more than one Entra ID tenant, repeat this setup for each tenant and add each tenant as a separate SSO provider. For more information, see Configure Multiple SSO Identity Provider Connections.

Create a New App Registration in Azure

Go to your Azure Active Directory Portal, and click on App Integrations on the left side menu. Click "New Registration"

Give your application a name, select "Accounts in this organizational directory only," and click "Register."

Copy the Application (Client) ID of your newly created App into a note.

Retrieve Issuer URL

In the "Overview" tab select "Endpoints" from the top menu. Copy the URL labeled "OpenID Connect metadata document" and paste in a new tab.

Copy the issuer link into a note, it should look like this: https://login.microsoftonline.com/XX...XX/v2.0

Create a Client Secret

From the "Overview" tab on your new Application, select "Add a Certificate or Secret"

Select "New Client Secret"

Enter suitable description, and choose when the secret will expire. We will choose 24 months, but longer expiration periods can be created if you set a custom range. Remember to create a new secret after the client secret expires, and then edit the SSO provider in CCC and enter the new Client Secret. Click Add.

Be sure to copy your client secret and paste into your note. It only appears once, and will be hidden if you do not copy it before leaving this page. 

You should now have these three items copied into your notepad. You will need to enter these values into Cloud Control Center later.

Configure Optional Claims in Token Configuration

1. Select "Token Configuration" in the left menu and click "Add Optional Claim."
2. Select "Token Type = ID" and select the three following options: given_name, family_name, email
3. Confirm your selections and click "Add"

Verify Manifest Configuration

1. Click on manifest
2. Ensure "accessTokenAcceptedVersion" is set to 2; if it is null change it to 2.
3. Click save after changing the value.

Configuring API Permissions

After configuring optional claims, you must update the application’s API permissions to allow Azure AD to include the required OpenID Connect attributes in issued tokens. 

In the App Registration, navigate to API permissions, select Microsoft Graph, and choose Delegated permissions. 

Under OpenID permissions, ensure that email, offline_access, openid, and profile are selected. Save the changes to update the application permissions.

Create an App Role

Here we will create user roles that can be used grant different permissions to users who log into Cloud Control Center based on their user group in AAD. Lets create App Roles for the two default Cloud Control Center User Roles in this example: TenantAdmin and TenantUser.

TenantAdmin – This default role in Cloud Control Center has full read/write access

TenantUser – This is default role in Cloud Control Center is only able to view data

For TenantAdmin:

• Display name: TenantAdmin
• Allowed member types: Users/Groups
• Value: TenantAdmin (be sure this is typed correctly)
• Description: Read/Write Privileges for Tenant Admins
• Do you want to enable this app role? *Checked

Apply, and create another App Role for TenantUser.

Create User Groups in Your Directory

Next we need to create the user groups that will give users permissions to log in to Cloud Control Center via Azure SSO.

Click on Azure Active Directory -> Groups -> New Group

Create Security Groups for each Application Role we created (TenantAdmin, TenantUser)

Example:

Group type: Security

Group name: TenantAdmin

Group description: Elisity CCC Tenant Admin with Read/Write privileges

Membership type: Assigned

Owners: Select an owner for this group; can be person creating the group or managing Azure AD

Members: Select appropriate members (Member assignments/removal can also be done later by viewing the group from the Groups page)

Create a group for TenantUser or any additional user groups in the same fashion as above.

Assign user groups to Cloud Control Center Application in Azure

1. Assign groups to CCC App
2. Click on Azure Active Directory -> Enterprise Applications -> Search for CCC in the search box and select the application
3. Go to the Users and Groups tab -> Assign users and groups

1. Click on Users and Groups and select the appropriate group (TenantAdmin and TenantUser, or any other group you would like) 
2. Click on Select a role and select appropriate role (TenantAdmin or TenantUser)
3. Click Assign

*No screenshots available for this step currently*

 

Configure Application Properties in AAD

Assignment Required Field

Assignment Required: This field determines whether user access to the Elisity Cloud Control Center (CCC) is controlled based on group assignments.

• If "Assignment required" is unchecked:
  • All Users Can Login: Any user within the Azure AD tenant can log in to the CCC regardless of their group assignment.
  • No Access to Dashboards: Although users can log in, they will not have access to any dashboards or functionalities within CCC unless explicitly assigned to one of the pre-configured user groups.
• If "Assignment required" is checked:
  • Restricted Login Access: Only users who are explicitly assigned to the application (via group membership or direct user assignment) will be able to log in to CCC.
  • Deny Unassigned Users: Users not assigned to the application will be denied login access entirely, providing a stricter level of access control and ensuring that only authorized users can access the CCC environment.

To change this configuration, navigate to the Enterprise Application, go to Properties, and change the Assignment required? field to Yes.

Configure Azure SSO within Cloud Control Center

Method 1: Using the Discovery Endpoint for Azure SSO

Before using this method, you need to ensure that your Elisity Application and User Roles are already created in Azure SSO. If they are not, navigate to the respective sections to fulfill these requirements first.

Step 1. Sign in to Cloud Control Center (CCC) with an admin account that has permissions to make SSO configuration changes. Navigate to Settings > Administration, select the SSO Configuration tab and click + Add SSO Provider.

Step 2. Leave Use Discovery Endpoint turned on. In Discovery Endpoint, enter the OpenID Connect metadata document URL that you copied in Retrieve Issuer URL, and click Discover. This URL is the issuer URL with /.well-known/openid-configuration appended, for example https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration. When the message "Discovery endpoint is successful" appears, the Metadata fields are filled in. Expand Metadata to verify the values.

Step 3. In Name, enter the name users see on the login page, up to 60 characters (for example, your organization name).

Step 4. Enter the Client ID and Client Secret from your app registration. Keep the default Scopes (openid, email, profile and offline_access), which match the API permissions configured earlier.

Step 5. Click Add. The Connection created dialog displays the provider's Redirect URL. Click Copy, and then click Done.

Register the copied Redirect URL in Azure as described in Configuring Redirect URIs (Reply URL). Users cannot sign in through this SSO provider until the Redirect URL is registered.

Method 2: Manually Entering Metadata

You can optionally choose to bypass the Discovery Endpoint method and manually enter all the required configurations in Cloud Control Center. On the Add SSO Provider page, turn off Use Discovery Endpoint and enter the following fields:

• Name: The name users see on the login page, up to 60 characters.
• Client ID: The unique identifier assigned to your application by the SSO provider. This value can be found by following the guide above.
• Client Secret: A confidential secret used by your application to authenticate with the SSO provider. This value can be found by following the guide above.
• Scopes: The OpenID Connect scopes requested from the SSO provider. Keep the defaults (openid, email, profile and offline_access).
• Token Endpoint: The URL used by the application to exchange an authorization code for an access token.
• Authorization Endpoint: The URL used to initiate the user authorization process.
• JSON Web Key Set: The URL pointing to a set of public keys used to verify the signature of JSON Web Tokens.
• User Information Endpoint: The URL from which the application can retrieve user profile information.
• Issuer: The URL that uniquely identifies the authorization server that issued the token. This value can be found by following the guide above.

Refer to Azure Identity documentation on how to retrieve the values for manual configuration that are not covered in this document.

Click Add, and then copy the Redirect URL from the Connection created dialog as described in Method 1.

Configuring Redirect URIs (Reply URL)

After you add the SSO provider in Cloud Control Center, register its Redirect URL in your Azure app registration.

1. Click on Authentication from the side tab
2. Select Add a platform, and select the "Web" box.
3. Enter the Redirect URL that you copied from the Connection created dialog in Cloud Control Center. To copy it again, open the Actions menu for the SSO provider on the SSO Configuration tab and select View Redirect URL.
4. Leave front-channel logout URL empty.
5. Select Access Token and ID tokens from the check boxes.

Create SSO Role Configurations in Cloud Control Center

Before finalizing our SSO integration, we can quickly add our Key-Value to User Role configurations within Cloud Control Center. Azure AD uses a Key-Value pair for these API calls where the key is "roles" and the value type is User Groups. Any groups that are assigned to the Application Integration for Cloud Control Center (within Azure AD) can be mapped to a role in Cloud Control Center. Role mappings apply only to the SSO provider they are configured on.

Step 1. On the SSO Configuration tab, open the Actions menu for your Entra ID SSO provider and select Role Configuration.

Step 2. For any and every user group that you would like to map to a role in Cloud Control Center, click Add Role and enter the Key, Value and User Role. If you copied the syntax for the Key-Value pairs in this guide, the default User Roles should look exactly like this:

Any additional user groups you would like to map to custom roles can also be configured here. They should use the same key (Key = "roles") unless you configured your key-value differently. Key and Value are case sensitive. The value field should also match exactly the syntax of user groups assigned to your CCC Application within your IDP. You can then assign to any custom role you have created to effectively enable Role-Based Access Control for Cloud Control Center. An example might look like this:

In this example, SSO users who are members of the NetworkAdmins group are assigned the Virtual-Edges-Only custom role, which restricts their access to ONLY the Virtual Edge page.

Step 3. Click Save Changes. The message "Role mappers have been updated successfully." confirms the change.

Azure SSO Integration Completed

You should now be able to login to Cloud Control Center using SSO with Azure for users who have the appropriate attributes applied. Click Log In With SSO and, when more than one SSO provider is configured, select this provider by name. Then enter your credentials from Azure.