|
| 1 | +--- |
| 2 | +title: Trigger custom Logic Apps with Azure AD entitlement management |
| 3 | +description: Learn how to configure and use custom Logic Apps in Azure Active Directory entitlement management. |
| 4 | +services: active-directory |
| 5 | +documentationCenter: '' |
| 6 | +author: ajburnle |
| 7 | +manager: karenhoran |
| 8 | +editor: |
| 9 | +ms.service: active-directory |
| 10 | +ms.workload: identity |
| 11 | +ms.tgt_pltfrm: na |
| 12 | +ms.devlang: na |
| 13 | +ms.topic: how-to |
| 14 | +ms.subservice: compliance |
| 15 | +ms.date: 11/02/2020 |
| 16 | +ms.author: ajburnle |
| 17 | +ms.reviewer: |
| 18 | +ms.collection: M365-identity-device-management |
| 19 | + |
| 20 | +#Customer intent: As an administrator, I want detailed information about how I can configure and add custom Logic Apps to my catalogs and access packages in entitlement management. |
| 21 | + |
| 22 | +--- |
| 23 | +# Trigger custom Logic Apps with Azure AD entitlement management |
| 24 | + |
| 25 | + |
| 26 | +[Azure Logic Apps](https://docs.microsoft.com/azure/logic-apps/logic-apps-overview) can be used to automate custom workflows and connect apps and services in one place. Users can integrate Logic Apps with entitlement management to broaden their governance workflows beyond the core entitlement management use cases. |
| 27 | + |
| 28 | +These Logic Apps can then be triggered to run in accordance with entitlement management use cases such as when an access package is granted or requested. For example, an admin could create and link a custom Logic App to entitlement management so that when a user requests an access package, a Logic App is triggered that ensures the user is also assigned certain characteristics in a 3rd party SAAS app (like Salesforce) or is sent a custom email. |
| 29 | + |
| 30 | +entitlement management use cases that can be integrated with Logic Apps include: |
| 31 | + |
| 32 | +- when an access package is requested |
| 33 | + |
| 34 | +- when an access package request is granted |
| 35 | + |
| 36 | +- when an access package assignment expires |
| 37 | + |
| 38 | +These triggers to Logic Apps are controlled in a new tab within access package policies called **Rules**. Additionally, a **Custom Extensions** tab on the Catalog page will show all added Logic Apps for a given Catalog. This article describes how to create and add logic apps to catalogs and access packages in entitlement management. |
| 39 | + |
| 40 | +## Create and add a Logic App to a catalog for use in entitlement management |
| 41 | + |
| 42 | +**Prerequisite roles:** Global administrator, Identity Governance administrator, Catalog owner or Resource Group Owner |
| 43 | + |
| 44 | +1. Sign in to the [Azure portal](https://portal.azure.com). |
| 45 | + |
| 46 | +1. In the Azure portal, select **Azure Active Directory** and then select **Identity Governance**. |
| 47 | + |
| 48 | +1. In the left menu, select **Catalogs**. |
| 49 | + |
| 50 | +1. In the left menu, select **Custom Extensions (Preview)**. |
| 51 | + |
| 52 | +1. In the header navigation bar, select **Add a Custom Extension**. |
| 53 | + |
| 54 | +1. In the **Basics** tab, enter the name of the custom extension (linked Logic App you are adding) and description of the workflow. These fields will show up in the **Custom Extensions** tab of the Catalog going forward. |
| 55 | + |
| 56 | +  |
| 57 | + |
| 58 | + |
| 59 | +1. Then go on to the **Details** tab. |
| 60 | + |
| 61 | +1. Select **Yes** in the field “Create new logic app”. Otherwise, select **No** and move on to step 9 if you are going to use an existing Logic App. If you selected yes, select one of the options below and move on to step 9: |
| 62 | + |
| 63 | + 1. Select **create new Azure AD application** if you want to use a new application as the basis for the new Logic App, or |
| 64 | + |
| 65 | +  |
| 66 | + |
| 67 | + 1. select **an existing Azure AD Application** if you want to use an existing application as the basis for the new Logic App. |
| 68 | + |
| 69 | +  |
| 70 | + |
| 71 | + > [!Note] |
| 72 | + > Later, you can edit what your Logic App does in Logic App designer. To do so, select on the Logic App you created in the **Custom Extensions** tab of **Catalogs**. |
| 73 | +
|
| 74 | +1. Next, enter the **Subscription ID**, **Resource group**, **Logic app name**. |
| 75 | + |
| 76 | +1. Then, select **Validate and Create**. |
| 77 | + |
| 78 | +1. Review the summary of your custom extension and make sure the details for your Logic App callout are correct. Then select **Create**. |
| 79 | + |
| 80 | +  |
| 81 | + |
| 82 | +1. This custom extension to the linked Logic App will now appear in your Custom Extensions tab under Catalogs. You will be able to call on this in access package policies. |
| 83 | + |
| 84 | + |
| 85 | +## Edit a linked Logic App |
| 86 | + |
| 87 | +**Prerequisite roles:** Global administrator, Identity Governance administrator, or Catalog owner |
| 88 | + |
| 89 | +1. Sign in to the [Azure portal](https://portal.azure.com)l. |
| 90 | + |
| 91 | +1. In the Azure portal, select **Azure Active Directory** and then select **Identity Governance**. |
| 92 | + |
| 93 | +1. In the left menu, select **Catalogs**. |
| 94 | + |
| 95 | +1. In the left menu, select **Custom Extensions**. |
| 96 | + |
| 97 | +1. Here, you can view all custom extensions (Logic Apps) that you have added to this Catalog. To edit a Logic App workflow, or to create a workflow for a newly-added Logic App, select the Logic App custom extension under **Endpoint**. This will open Logic App Designer and allow you to create your workflow. |
| 98 | + |
| 99 | + For more information on creating Logic App workflows, see [Create automated workflows with Azure Logic Apps in the Azure portal](https://docs.microsoft.com/azure/logic-apps/quickstart-create-first-logic-app-workflow). |
| 100 | + |
| 101 | +## Add custom extension to access package policy |
| 102 | + |
| 103 | +**Prerequisite roles:** Global administrator, Identity Governance administrator, Catalog owner, or Access package manager |
| 104 | + |
| 105 | +1. Sign in to the [Azure portal](https://portal.azure.com). |
| 106 | + |
| 107 | +1. In the Azure portal, select **Azure Active Directory** and then select **Identity Governance**. |
| 108 | + |
| 109 | +1. In the left menu, select **Access packages**. |
| 110 | + |
| 111 | +1. Select **New access package** if you want to add a custom extension (Logic App) to a new access package. Or select the access package you want to add a custom extension (Logic App) to from the list of access packages that have already been created. |
| 112 | + |
| 113 | + > [!NOTE] |
| 114 | + > For more information about how to create an access package see [Create a new access package in entitlement management](entitlement-management-access-package-create.md). For more information about how to edit an existing access package, see [Change request settings for an access package in Azure AD entitlement management](entitlement-management-access-package-request-policy.md#open-and-edit-an-existing-policy-of-request-settings). |
| 115 | +
|
| 116 | +1. In the policy settings of the access package, go to the **Rules (Preview)** tab. |
| 117 | + |
| 118 | +1. In the menu below **When**, select the access package event you wish to use as trigger for this custom extension (Logic App). For example, if you only want to trigger the custom extension Logic App workflow when a user requests the access package, select **when request is created**. |
| 119 | + |
| 120 | +1. In the menu below **Do**, select the custom extension (Logic App) you want to add to the access package. The do action you select will execute when the event selected in the when field occurs. |
| 121 | + |
| 122 | +1. Select **Create** if you want to add the custom extension to a new access package. Select **Update** if you want to add it to an existing access package. |
| 123 | + |
| 124 | +  |
| 125 | + |
| 126 | +## Troubleshooting and Validation |
| 127 | + |
| 128 | +To verify that your custom extension has correctly triggered the associated Logic App when called upon by the access package **Do** option, you can view the Logic App logs. |
| 129 | + |
| 130 | +The overview page for a specific Logic App will show timestamps of when the Logic App was last executed. Also, the Resource Group overview for a resource group with a linked custom extension will show the name of that custom extension in the overview if it has been configured correctly. |
| 131 | + |
| 132 | +## Next steps |
0 commit comments