|
| 1 | +--- |
| 2 | +title: 'Tutorial: Configure 4me for automatic user provisioning with Azure Active Directory | Microsoft Docs' |
| 3 | +description: Learn how to configure Azure Active Directory to automatically provision and de-provision user accounts to 4me. |
| 4 | +services: active-directory |
| 5 | +documentationcenter: '' |
| 6 | +author: zchia |
| 7 | +writer: zchia |
| 8 | +manager: beatrizd |
| 9 | + |
| 10 | +ms.assetid: na |
| 11 | +ms.service: active-directory |
| 12 | +ms.component: saas-app-tutorial |
| 13 | +ms.workload: identity |
| 14 | +ms.tgt_pltfrm: na |
| 15 | +ms.devlang: na |
| 16 | +ms.topic: article |
| 17 | +ms.date: 06/3/2019 |
| 18 | +ms.author: zchia |
| 19 | +--- |
| 20 | + |
| 21 | +# Tutorial: Configure 4me for automatic user provisioning |
| 22 | + |
| 23 | +The objective of this tutorial is to demonstrate the steps to be performed in 4me and Azure Active Directory (Azure AD) to configure Azure AD to automatically provision and de-provision users and/or groups to 4me. |
| 24 | + |
| 25 | +> [!NOTE] |
| 26 | +> This tutorial describes a connector built on top of the Azure AD User Provisioning Service. For important details on what this service does, how it works, and frequently asked questions, see [Automate user provisioning and deprovisioning to SaaS applications with Azure Active Directory](../manage-apps/user-provisioning.md). |
| 27 | +> |
| 28 | +> This connector is currently in Public Preview. For more information on the general Microsoft Azure terms of use for Preview features, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/). |
| 29 | +
|
| 30 | +## Prerequisites |
| 31 | + |
| 32 | +The scenario outlined in this tutorial assumes that you already have the following prerequisites: |
| 33 | + |
| 34 | +* An Azure AD tenant |
| 35 | +* [A 4me tenant](https://www.4me.com/trial/) |
| 36 | +* A user account in 4me with Admin permissions. |
| 37 | + |
| 38 | +## Add 4me from the gallery |
| 39 | + |
| 40 | +Before configuring 4me for automatic user provisioning with Azure AD, you need to add 4me from the Azure AD application gallery to your list of managed SaaS applications. |
| 41 | + |
| 42 | +**To add 4me from the Azure AD application gallery, perform the following steps:** |
| 43 | + |
| 44 | +1. In the **[Azure portal](https://portal.azure.com)**, in the left navigation panel, select **Azure Active Directory**. |
| 45 | + |
| 46 | +  |
| 47 | + |
| 48 | +2. Go to **Enterprise applications**, and then select **All applications**. |
| 49 | + |
| 50 | +  |
| 51 | + |
| 52 | +3. To add a new application, select the **New application** button at the top of the pane. |
| 53 | + |
| 54 | +  |
| 55 | + |
| 56 | +4. In the search box, enter **4me**, select **4me** in the results panel, and then click the **Add** button to add the application. |
| 57 | + |
| 58 | +  |
| 59 | + |
| 60 | +## Assigning users to 4me |
| 61 | + |
| 62 | +Azure Active Directory uses a concept called *assignments* to determine which users should receive access to selected apps. In the context of automatic user provisioning, only the users and/or groups that have been assigned to an application in Azure AD are synchronized. |
| 63 | + |
| 64 | +Before configuring and enabling automatic user provisioning, you should decide which users and/or groups in Azure AD need access to 4me. Once decided, you can assign these users and/or groups to 4me by following the instructions here: |
| 65 | + |
| 66 | +* [Assign a user or group to an enterprise app](../manage-apps/assign-user-or-group-access-portal.md) |
| 67 | + |
| 68 | +### Important tips for assigning users to 4me |
| 69 | + |
| 70 | +* It is recommended that a single Azure AD user is assigned to 4me to test the automatic user provisioning configuration. Additional users and/or groups may be assigned later. |
| 71 | + |
| 72 | +* When assigning a user to 4me, you must select any valid application-specific role (if available) in the assignment dialog. Users with the **Default Access** role are excluded from provisioning. |
| 73 | + |
| 74 | +## Configuring automatic user provisioning to 4me |
| 75 | + |
| 76 | +This section guides you through the steps to configure the Azure AD provisioning service to create, update, and disable users and/or groups in 4me based on user and/or group assignments in Azure AD. |
| 77 | + |
| 78 | +> [!TIP] |
| 79 | +> You may also choose to enable SAML-based single sign-on for 4me, following the instructions provided in the [4me single sign-on tutorial](4me-tutorial.md). Single sign-on can be configured independently of automatic user provisioning, though these two features compliment each other. |
| 80 | +
|
| 81 | +### To configure automatic user provisioning for 4me in Azure AD: |
| 82 | + |
| 83 | +1. Sign in to the [Azure portal](https://portal.azure.com). Select **Enterprise Applications**, then select **All applications**. |
| 84 | + |
| 85 | +  |
| 86 | + |
| 87 | +2. In the applications list, select **4me**. |
| 88 | + |
| 89 | +  |
| 90 | + |
| 91 | +3. Select the **Provisioning** tab. |
| 92 | + |
| 93 | +  |
| 94 | + |
| 95 | +4. Set the **Provisioning Mode** to **Automatic**. |
| 96 | + |
| 97 | +  |
| 98 | + |
| 99 | +5. To retrieve the **Tenant URL** and **Secret Token** of your 4me account, follow the walkthrough as described in Step 6. |
| 100 | + |
| 101 | +6. Sign in to your 4me Admin Console. Navigate to **Settings**. |
| 102 | + |
| 103 | +  |
| 104 | + |
| 105 | + Type in **apps** in the search bar. |
| 106 | + |
| 107 | +  |
| 108 | + |
| 109 | + Open the **SCIM** dropdown to retrieve the Secret Token and the SCIM endpoint. |
| 110 | + |
| 111 | +  |
| 112 | + |
| 113 | +7. Upon populating the fields shown in Step 5, click **Test Connection** to ensure Azure AD can connect to 4me. If the connection fails, ensure your 4me account has Admin permissions and try again. |
| 114 | + |
| 115 | +  |
| 116 | + |
| 117 | +8. In the **Notification Email** field, enter the email address of a person or group who should receive the provisioning error notifications and check the checkbox - **Send an email notification when a failure occurs**. |
| 118 | + |
| 119 | +  |
| 120 | + |
| 121 | +9. Click **Save**. |
| 122 | + |
| 123 | +10. Under the **Mappings** section, select **Synchronize Azure Active Directory Users to 4me**. |
| 124 | + |
| 125 | +  |
| 126 | + |
| 127 | +11. Review the user attributes that are synchronized from Azure AD to 4me in the **Attribute Mapping** section. The attributes selected as **Matching** properties are used to match the user accounts in 4me for update operations. Select the **Save** button to commit any changes. |
| 128 | + |
| 129 | +  |
| 130 | + |
| 131 | +12. Under the **Mappings** section, select **Synchronize Azure Active Directory Groups to 4me**. |
| 132 | + |
| 133 | +  |
| 134 | + |
| 135 | +13. Review the group attributes that are synchronized from Azure AD to 4me in the **Attribute Mapping** section. The attributes selected as **Matching** properties are used to match the groups in 4me for update operations. Select the **Save** button to commit any changes. |
| 136 | + |
| 137 | +  |
| 138 | + |
| 139 | +14. To configure scoping filters, refer to the following instructions provided in the [Scoping filter tutorial](../manage-apps/define-conditional-rules-for-provisioning-user-accounts.md). |
| 140 | + |
| 141 | +15. To enable the Azure AD provisioning service for 4me, change the **Provisioning Status** to **On** in the **Settings** section. |
| 142 | + |
| 143 | +  |
| 144 | + |
| 145 | +16. Define the users and/or groups that you would like to provision to 4me by choosing the desired values in **Scope** in the **Settings** section. |
| 146 | + |
| 147 | +  |
| 148 | + |
| 149 | +17. When you are ready to provision, click **Save**. |
| 150 | + |
| 151 | +  |
| 152 | + |
| 153 | +This operation starts the initial synchronization of all users and/or groups defined in **Scope** in the **Settings** section. The initial sync takes longer to perform than subsequent syncs, which occur approximately every 40 minutes as long as the Azure AD provisioning service is running. You can use the **Synchronization Details** section to monitor progress and follow links to provisioning activity report, which describes all actions performed by the Azure AD provisioning service on 4me. |
| 154 | + |
| 155 | +For more information on how to read the Azure AD provisioning logs, see [Reporting on automatic user account provisioning](../manage-apps/check-status-user-account-provisioning.md). |
| 156 | + |
| 157 | +## Connector Limitations |
| 158 | + |
| 159 | +* 4me has different SCIM endpoint URLs for test and production environments. The former ends with **.qa** while the latter ends with **.com** |
| 160 | +* 4me generated Secret Tokens have an expiration date of a month from generation. |
| 161 | +* 4me doesn’t support **DELETE** operations |
| 162 | + |
| 163 | +## Additional resources |
| 164 | + |
| 165 | +* [Managing user account provisioning for Enterprise Apps](../manage-apps/configure-automatic-user-provisioning-portal.md) |
| 166 | +* [What is application access and single sign-on with Azure Active Directory?](../manage-apps/what-is-single-sign-on.md) |
| 167 | + |
| 168 | +## Next steps |
| 169 | + |
| 170 | +* [Learn how to review logs and get reports on provisioning activity](../manage-apps/check-status-user-account-provisioning.md) |
0 commit comments