Office 365 Account Provider

To allow users to sign in with your Office 365 subscription:

  • Set up and configure an App in the Office 365 Azure AD tenant
  • Activate an Office 365 Account Provider (see Activate an Account Provider)
  • Set the configuration parameters on the Office 365 Account Provider

Configure an App in the Office 365 Azure AD tenant

  1. Login to the Azure AD portal tenant of your Office 365 subscription.
  2. On the left side click All services and in the Filter type Azure Active Directory.
  3. Click New registration.
  4. In Name type a unique display name for the application.
  5. Under Redirect URI select Web and type https://www.theidentityhub.com/{tenant}/authenticate/processaccountproviderresponse.
  6. Click Register.
  7. Take a note of the Application (client) ID.
  8. On the left: click Certificates & secrets.
  9. Click New client secret.
  10. In Description type The Identity Hub and select Expires > Never.
  11. Click Add.
  12. Take a note of the VALUE you will need it as App Password later on.
  13. On the left: click API permissions.
  14. Click Add a permission and select Microsoft Graph.
  15. Click Delegated permissions and scroll down to User.
  16. Check User.Read and User.ReadBasic.All.
  17. Scroll to Directory and check Directory.AccessAsUser.All.
  18. Click Add permissions.
  19. Click Grant admin consent for [AZURE AD TENANT NAME] (requires administrator rights).

Specific configuration parameters for the Office 365 Account Provider

Parameter Description
App ID The Application (client) ID of the App created on the Azure Portal (see Configure an App in the Office 365 Azure AD tenant).
App Password The client secret VALUE of the App created on the Azure Portal (see Configure an App in the Office 365 Azure AD tenant).

Map incoming information

Parameter Description
Email address The claim type to which to map the email address coming from Office 365.
Note

The email address for the user will be taken from the mail property. The mail property is set when the user has an Office 365 or Exchange mailbox. When the mail property is not set, an attempt will be made to get the email address from the first entry in the otherMails property. See https://docs.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0#properties.

Map incoming roles

To map an incoming Role (AD Security Group): specify the name of the incoming Role and the name of the Role known in the Tenant.

Parameter Description
Remove all incoming roles that are not mapped Only explicitly mapped incoming roles are mapped. All other incoming roles are ignored.
Incoming Role The name of the incoming Role (AD Security Group).
Mapped Role The name of the Role as known in the Tenant.

Amazon Account Provider
Activate an Account Provider
Built-in Username and Password Account Provider
Custom Account Providers)
Facebook Account Provider GitHub Account Provider
Google Account Provider
Instagram Account Provider
LinkedIn Account Provider
Microsoft Account Provider
PayPal Account Provider
SAML-P Account Provider
StackExchange Account Provider
Twitter Account Provider
WS-Federation Account Provider