You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/saas-apps/adpfederatedsso-tutorial.md
+39-63Lines changed: 39 additions & 63 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,5 @@
1
1
---
2
-
title: 'Tutorial: Azure Active Directory integration with ADP | Microsoft Docs'
2
+
title: 'Tutorial: Azure Active Directory single sign-on (SSO) integration with ADP | Microsoft Docs'
3
3
description: Learn how to configure single sign-on between Azure Active Directory and ADP.
4
4
services: active-directory
5
5
documentationCenter: na
@@ -14,13 +14,13 @@ ms.workload: identity
14
14
ms.tgt_pltfrm: na
15
15
ms.devlang: na
16
16
ms.topic: tutorial
17
-
ms.date: 07/25/2019
17
+
ms.date: 08/26/2019
18
18
ms.author: jeedes
19
19
20
20
ms.collection: M365-identity-device-management
21
21
---
22
22
23
-
# Tutorial: Integrate ADP with Azure Active Directory
23
+
# Tutorial: Azure Active Directory single sign-on (SSO) integration with ADP
24
24
25
25
In this tutorial, you'll learn how to integrate ADP with Azure Active Directory (Azure AD). When you integrate ADP with Azure AD, you can:
26
26
@@ -43,6 +43,9 @@ In this tutorial, you configure and test Azure AD SSO in a test environment.
43
43
44
44
* ADP supports **IDP** initiated SSO
45
45
46
+
> [!NOTE]
47
+
> Identifier of this application is a fixed string value so only one instance can be configured in one tenant.
48
+
46
49
## Adding ADP from the gallery
47
50
48
51
To configure the integration of ADP into Azure AD, you need to add ADP from the gallery to your list of managed SaaS apps.
@@ -54,21 +57,20 @@ To configure the integration of ADP into Azure AD, you need to add ADP from the
54
57
1. In the **Add from the gallery** section, type **ADP** in the search box.
55
58
1. Select **ADP** from results panel and then add the app. Wait a few seconds while the app is added to your tenant.
56
59
57
-
58
-
## Configure and test Azure AD single sign-on
60
+
## Configure and test Azure AD single sign-on for ADP
59
61
60
62
Configure and test Azure AD SSO with ADP using a test user called **B.Simon**. For SSO to work, you need to establish a link relationship between an Azure AD user and the related user in ADP.
61
63
62
64
To configure and test Azure AD SSO with ADP, complete the following building blocks:
63
65
64
66
1.**[Configure Azure AD SSO](#configure-azure-ad-sso)** - to enable your users to use this feature.
67
+
1. **[Create an Azure AD test user](#create-an-azure-ad-test-user)** - to test Azure AD single sign-on with B.Simon.
68
+
1. **[Assign the Azure AD test user](#assign-the-azure-ad-test-user)** - to enable B.Simon to use Azure AD single sign-on.
65
69
2.**[Configure ADP SSO](#configure-adp-sso)** - to configure the Single Sign-On settings on application side.
66
-
3.**[Create an Azure AD test user](#create-an-azure-ad-test-user)** - to test Azure AD single sign-on with B.Simon.
67
-
4.**[Assign the Azure AD test user](#assign-the-azure-ad-test-user)** - to enable B.Simon to use Azure AD single sign-on.
68
-
5.**[Create ADP test user](#create-adp-test-user)** - to have a counterpart of B.Simon in ADP that is linked to the Azure AD representation of user.
69
-
6.**[Test SSO](#test-sso)** - to verify whether the configuration works.
70
+
1. **[Create ADP test user](#create-adp-test-user)** - to have a counterpart of B.Simon in ADP that is linked to the Azure AD representation of user.
71
+
3.**[Test SSO](#test-sso)** - to verify whether the configuration works.
70
72
71
-
###Configure Azure AD SSO
73
+
## Configure Azure AD SSO
72
74
73
75
Follow these steps to enable Azure AD SSO in the Azure portal.
74
76
@@ -95,42 +97,45 @@ Follow these steps to enable Azure AD SSO in the Azure portal.
95
97
In the **Identifier (Entity ID)** text box, type a URL:
96
98
`https://fed.adp.com`
97
99
98
-
5. ADP application expects the SAML assertions in a specific format, which requires you to add custom attribute mappings to your SAML token attributes configuration. The following screenshot shows the list of default attributes. Click **Edit** icon to open User Attributes dialog. The claim name will always be **PersonImmutableID** and the value of which we shown that to map with **employeeid**.
99
-
100
-
The user mapping from Azure AD to ADP will be done on the **employeeid** but you can map this to a different value based on your application settings. So please work with [ADP support team](https://www.adp.com/contact-us/overview.aspx) first to use the correct identifier of a user and map that value with the **PersonImmutableID** claim.
101
-
102
-

100
+
4. On the **Set up Single Sign-On with SAML** page, in the **SAML Signing Certificate** section, find **Federation Metadata XML** and select **Download** to download the certificate and save it on your computer.
103
101
104
-
6. In addition to above, ADP application expects few more attributes to be passed back in SAML response. In the User Claims section on the User Attributes dialog, perform the following steps to add SAML token attribute as shown in the below table:
1. Select the **Show password** check box, and then write down the value that's displayed in the **Password** box.
118
+
1. Click **Create**.
117
119
118
-
e. From the **Source attribute** list, type the attribute value shown for that row.
120
+
### Assign the Azure AD test user
119
121
120
-
f. Click **Save**.
122
+
In this section, you'll enable B.Simon to use Azure single sign-on by granting access to ADP.
121
123
122
-
> [!NOTE]
123
-
> Before you can configure the SAML assertion, you need to contact your [ADP support team](https://www.adp.com/contact-us/overview.aspx) and request the value of the unique user identifier attribute for your tenant. You need this value to configure the custom claim for your application.
124
+
1. In the Azure portal, select **Enterprise Applications**, and then select **All applications**.
125
+
1. In the applications list, select **ADP**.
126
+
1. In the app's overview page, find the **Manage** section and select **Users and groups**.
124
127
125
-
4. On the **Set up Single Sign-On with SAML** page, in the **SAML Signing Certificate** section, find **Federation Metadata XML**and select **Download** to download the certificate and save it on your computer.
128
+

1. In the **Users and groups** dialog, select **B.Simon** from the Users list, then click the **Select** button at the bottom of the screen.
135
+
1. If you're expecting any role value in the SAML assertion, in the **Select Role** dialog, select the appropriate role for the user from the list and then click the **Select** button at the bottom of the screen.
136
+
1. In the **Add Assignment** dialog, click the **Assign** button.
132
137
133
-
###Configure ADP SSO
138
+
## Configure ADP SSO
134
139
135
140
To configure single sign-on on **ADP** side, you need to upload the downloaded **Metadata XML** on the [ADP website](https://adpfedsso.adp.com/public/login/index.fcc).
136
141
@@ -203,41 +208,11 @@ Upon receipt of confirmation from your ADP representative, configure your ADP se
203
208
204
209
11. On confirmation of a successful test, assign the federated ADP service to individual users or user groups, which is explained later in the tutorial and roll it out to your employees.
205
210
206
-
### Create an Azure AD test user
207
-
208
-
In this section, you'll create a test user in the Azure portal called B.Simon.
209
-
210
-
1. From the left pane in the Azure portal, select **Azure Active Directory**, select **Users**, and then select **All users**.
211
-
1. Select **New user** at the top of the screen.
212
-
1. In the **User** properties, follow these steps:
1. Select the **Show password** check box, and then write down the value that's displayed in the **Password** box.
216
-
1. Click **Create**.
217
-
218
-
### Assign the Azure AD test user
219
-
220
-
In this section, you'll enable B.Simon to use Azure single sign-on by granting access to ADP.
221
-
222
-
1. In the Azure portal, select **Enterprise Applications**, and then select **All applications**.
223
-
1. In the applications list, select **ADP**.
224
-
1. In the app's overview page, find the **Manage** section and select **Users and groups**.
225
-
226
-

227
-
228
-
1. Select **Add user**, then select **Users and groups** in the **Add Assignment** dialog.
229
-
230
-

231
-
232
-
1. In the **Users and groups** dialog, select **B.Simon** from the Users list, then click the **Select** button at the bottom of the screen.
233
-
1. If you're expecting any role value in the SAML assertion, in the **Select Role** dialog, select the appropriate role for the user from the list and then click the **Select** button at the bottom of the screen.
234
-
1. In the **Add Assignment** dialog, click the **Assign** button.
235
-
236
211
### Create ADP test user
237
212
238
213
The objective of this section is to create a user called B.Simon in ADP. Work with [ADP support team](https://www.adp.com/contact-us/overview.aspx) to add the users in the ADP account.
239
214
240
-
###Test SSO
215
+
## Test SSO
241
216
242
217
In this section, you test your Azure AD single sign-on configuration using the Access Panel.
243
218
@@ -251,3 +226,4 @@ When you click the ADP tile in the Access Panel, you should be automatically sig
251
226
252
227
-[What is conditional access in Azure Active Directory?](https://docs.microsoft.com/azure/active-directory/conditional-access/overview)
253
228
229
+
-[Try ADP with Azure AD](https://aad.portal.azure.com)
0 commit comments