You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/manage-apps/assign-user-or-group-access-portal.md
+50-31Lines changed: 50 additions & 31 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,54 +8,67 @@ ms.service: active-directory
8
8
ms.subservice: app-mgmt
9
9
ms.workload: identity
10
10
ms.topic: conceptual
11
-
ms.date: 10/24/2019
11
+
ms.date: 02/21/2020
12
12
ms.author: mimart
13
13
ms.reviewer: luleon
14
14
ms.collection: M365-identity-device-management
15
15
---
16
16
17
17
# Assign a user or group to an enterprise app in Azure Active Directory
18
18
19
-
To assign a user or group to an enterprise app, you should have assigned any of these admin roles: global administrator, application administrator, cloud application administrator or be assigned as the owner of the enterprise app. For Microsoft Applications (such as Office 365 apps), use PowerShell to assign users to an enterprise app.
19
+
This article shows you how to assign users or groups to enterprise applications in Azure Active Directory (Azure AD), either from within the Azure portal or by using PowerShell. When you assign a user to an application, the application appears in the user's [My Apps](https://myapps.microsoft.com/) access panel so they can easily access it.
20
+
21
+
For greater control over who can access an application, certain types of enterprise applications can be configured to *require* user assignment. With this option, you can limit access to only those users or groups that you've assigned to the application. If you don't require user assignment, all your users can navigate directly to the application’s URL (known as service provider-initiated sign-on), or they can use the **User Access URL** on an application’s **Properties** page (known as identity provider-initiated sign on). But by requiring user assignment, only those users you've assigned to the application can access it.
22
+
23
+
To assign a user or group to an enterprise app, you'll need to sign in as a global administrator, application administrator, cloud application administrator, or the assigned owner of the enterprise app.
24
+
25
+
If you want to assign users to Microsoft Applications such as Office 365 apps, use PowerShell. You can also show or hide Office 365 applications in the My Apps access panel by [setting an option in the Enterprise applications **User settings**](hide-application-from-user-portal.md).
20
26
21
27
> [!NOTE]
22
-
> For licensing requirements for the features discussed in this article, see the [Azure Active Directory pricing page](https://azure.microsoft.com/pricing/details/active-directory).
28
+
> Group-based assignment requires a paid Azure AD subscription and is determined by your [license agreement](https://azure.microsoft.com/pricing/details/active-directory). Group-based assignment is supported for Security groups only. Nested group memberships and Office 365 groups are not currently supported.
23
29
24
-
## Assign a user to an app - portal
30
+
## Configure an application to require user assignment
25
31
26
-
1. Sign in to the [Azure portal](https://portal.azure.com) with an account that's a global admin for the directory.
27
-
1. Select **All services**, enter Azure Active Directory in the text box, and then select **Enter**.
28
-
1. Select **Enterprise applications**.
29
-
1. On the **Enterprise applications - All applications** pane, you see a list of the apps you can manage. Select an app.
30
-
1. On the ***appname*** pane (that is, the pane with the name of the selected app in the title), select **Users & Groups**.
31
-
1. On the ***appname*****- User and groups** pane, select **Add user**.
32
-
1. On the **Add Assignment** pane, select **Users and groups**.
32
+
With the following types of applications, you have the option of requiring users to be assigned to the application before they can access it:
33
33
34
-
34
+
- Applications configured for federated single sign-on (SSO) with SAML-based authentication
35
+
- Application Proxy applications that use Azure Active Directory Pre-Authentication
36
+
- Applications built on the Azure AD application platform that use OAuth 2.0 / OpenID Connect Authentication after a user or admin has consented to that application.
37
+
38
+
When assignment is not required, either because you've set this option to **No** or because the application uses another SSO mode, users can access the application with a direct link. Note that this setting doesn't affect whether or not an application appears on the My Apps access panel. Applications appear on users' My Apps access panels once you've assigned a user or group to the application.
39
+
40
+
To require assignment:
41
+
42
+
1. Sign in to the [Azure portal](https://portal.azure.com) with an administrator account, or as an owner of the application.
35
43
36
-
1. On the **Users and groups** pane, select one or more users or groups from the list and then choose the **Select** button at the bottom of the pane.
37
-
1. On the **Add Assignment** pane, select **Role**. Then, on the **Select Role** pane, select a role to apply to the selected users or groups, then select **OK** at the bottom of the pane.
38
-
1. On the **Add Assignment** pane, select the **Assign** button at the bottom of the pane. The assigned users or groups have the permissions defined by the selected role for this enterprise app.
44
+
2. Select **Azure Active Directory**. In the left navigation menu, select **Enterprise applications**.
39
45
40
-
## Allow all users to access an app - portal
46
+
3. Select the application from the list. If you don't see the application, start typing its name in the search box. Or use the filter controls to select the application type, status, or visibility, and then select **Apply**.
41
47
42
-
1. Sign in to the [Azure portal](https://portal.azure.com) with an account that's a global admin for the directory.
43
-
1. Select **All services**, enter Azure Active Directory in the text box, and then select **Enter**.
44
-
1. Select **Enterprise applications**.
45
-
1. On the **Enterprise applications** pane, select **All applications**. This lists the apps you can manage.
46
-
1. On the **Enterprise applications - All applications** pane, select an app.
47
-
1. On the ***appname*** pane, select **Properties**.
48
-
1. On the ***appname* - Properties** pane, set the **User assignment required?** setting to **No**.
48
+
4. In the left navigation menu, select **Properties**.
49
49
50
-
The **User assignment required?**option:
50
+
5. Make sure the **User assignment required?**toggle is set to **Yes**.
51
51
52
-
- If this option is set to yes, then users must first be assigned to this application before being able to access it.
53
-
- If this option is set to no, then any users who navigate to the application deep-link URL or application URL directly will be granted access
54
-
- Doesn't affect whether or not an application appears on the application access panel. To show the application on the access panel, you need to assign an appropriate user or group to the application.
55
-
- Only functions with the cloud applications that are configured for SAML single sign-on, Application Proxy applications that use Azure Active Directory Pre-Authentication or applications built directly on the Azure AD application platform that use OAuth 2.0 / OpenID Connect Authentication after a user or admin has consented to that application. See [Single sign-on for applications](what-is-single-sign-on.md). See [Configure the way end-users consent to an application](configure-user-consent.md).
56
-
- This option has no effect when an application is configured for any of the other Single Sign-on modes.
52
+
6. Select the **Save** button at the top of the screen.
57
53
58
-
## Assign a user to an app - PowerShell
54
+
## Assign users or groups to an app via the Azure portal
55
+
56
+
1. Sign in to the [Azure portal](https://portal.azure.com) with an administrator account, or as an owner of the application.
57
+
2. Select **Azure Active Directory**. In the left navigation menu, select **Enterprise applications**.
58
+
3. Select the application from the list. If you don't see the application, start typing its name in the search box. Or use the filter controls to select the application type, status, or visibility, and then select **Apply**.
59
+
4. In the left navigation menu, select **Users and groups**.
60
+
5. Select the **Add user** button.
61
+
6. On the **Add Assignment** pane, select **Users and groups**.
62
+
7. Select the user or group you want to assign to the application, or start typing the name of the user or group in the search box. You can choose multiple users and groups, and your selections will appear under **Selected items**.
63
+
8. When finished, click **Select**.
64
+
65
+
66
+
67
+
9. On the **Users and groups** pane, select one or more users or groups from the list and then choose the **Select** button at the bottom of the pane.
68
+
10. If the application supports it, you can assign a role to the user or group. On the **Add Assignment** pane, select **Role**. Then, on the **Select Role** pane, choose a role to apply to the selected users or groups, then select **OK** at the bottom of the pane. Otherwise, the default access role is assigned, which means the application manages the level of access users have.
69
+
11. On the **Add Assignment** pane, select the **Assign** button at the bottom of the pane.
70
+
71
+
## Assign users or groups to an app via PowerShell
59
72
60
73
1. Open an elevated Windows PowerShell command prompt.
61
74
@@ -123,7 +136,13 @@ This example assigns the user Britta Simon to the [Microsoft Workplace Analytics
# How to configure self-service application assignment
22
22
23
-
Before your users can self-discover applications from their access panel, you need to enable **Self-service application access** to any applications that you wish to allow users to self-discover and request access to. This functionality is available for applications that were added from the [Azure AD Gallery](https://docs.microsoft.com/azure/active-directory/manage-apps/add-gallery-app), [Azure AD Application Proxy](https://docs.microsoft.com/azure/active-directory/manage-apps/application-proxy) or were added via [user or admin consent](https://docs.microsoft.com/azure/active-directory/develop/application-consent-experience).
23
+
Before your users can self-discover applications from their My Apps access panel, you need to enable **Self-service application access** to any applications that you wish to allow users to self-discover and request access to. This functionality is available for applications that were added from the [Azure AD Gallery](https://docs.microsoft.com/azure/active-directory/manage-apps/add-gallery-app), [Azure AD Application Proxy](https://docs.microsoft.com/azure/active-directory/manage-apps/application-proxy) or were added via [user or admin consent](https://docs.microsoft.com/azure/active-directory/develop/application-consent-experience).
24
24
25
25
This feature is a great way for you to save time and money as an IT group, and is highly recommended as part of a modern applications deployment with Azure Active Directory.
26
26
27
27
Using this feature, you can:
28
28
29
-
- Let users self-discover applications from the [Application Access Panel](https://myapps.microsoft.com/) without bothering the IT group.
29
+
- Let users self-discover applications from the [My Apps access panel](https://myapps.microsoft.com/) without bothering the IT group.
30
30
31
31
- Add those users to a pre-configured group so you can see who has requested access, remove access, and manage the roles assigned to them.
32
32
@@ -40,51 +40,39 @@ Using this feature, you can:
40
40
41
41
## Enable self-service application access to allow users to find their own applications
42
42
43
-
Self-service application access is a great way to allow users to self-discover applications, optionally allow the business group to approve access to those applications. You can allow the business group to manage the credentials assigned to those users for Password Single-Sign On Applications right from their access panels.
43
+
Self-service application access is a great way to allow users to self-discover applications, and optionally allow the business group to approve access to those applications. For password single-sign on applications, you can also allow the business group to manage the credentials assigned to those users from their own My Apps access panels.
44
44
45
45
To enable self-service application access to an application, follow the steps below:
46
46
47
-
1. Open the [**Azure portal**](https://portal.azure.com/) and sign in as a **Global Administrator.**
47
+
1.Sign in to the [Azure portal](https://portal.azure.com)as a Global Administrator.
48
48
49
-
2. Open the **Azure Active Directory Extension** by clicking **All services** at the top of the main left hand navigation menu.
49
+
2.Select **Azure Active Directory**. In the left navigation menu, select **Enterprise applications**.
50
50
51
-
3. Type in **“Azure Active Directory**” in the filter search box and select the **Azure Active Directory** item.
51
+
3.Select the application from the list. If you don't see the application, start typing its name in the search box. Or use the filter controls to select the application type, status, or visibility, and then select **Apply**.
52
52
53
-
4. click **Enterprise Applications** from the Azure Active Directory left hand navigation menu.
53
+
4.In the left navigation menu, select **Self-service**.
54
54
55
-
5. click **All Applications**to view a list of all your applications.
55
+
5.To enable Self-service application access for this application, turn the **Allow users to request access to this application?** toggle to **Yes.**
56
56
57
-
* If you do not see the application you want show up here, use the **Filter** control at the top of the **All Applications List** and set the **Show** option to **All Applications.**
58
-
59
-
6. Select the application you want to enable Self-service access to from the list.
60
-
61
-
7. Once the application loads, click **Self-service** from the application’s left hand navigation menu.
62
-
63
-
8. To enable Self-service application access for this application, turn the **Allow users to request access to this application?** toggle to **Yes.**
64
-
65
-
9. Next, to select the group to which users who request access to this application should be added, click the selector next to the label **To which group should assigned users be added?** and select a group.
57
+
6. Next to **To which group should assigned users be added?**, click **Select group**. Choose a group, and then click **Select**. When a user's request is approved, they'll be added to this group. When viewing this group's membership, you'll be able to see who has been granted access to the application through self-service access.
66
58
67
59
> [!NOTE]
68
-
> Groups synchronized from on-premises are not supported to be used for the group to which users who request access to this application should be added.
69
-
70
-
10.**Optional:** If you wish to require a business approval before users are allowed access, set the **Require approval before granting access to this application?** toggle to **Yes**.
60
+
> This setting doesn't support groups synchronized from on-premises.
71
61
72
-
11.**Optional: For applications using password single-sign on only,**if you wish to allow those business approvers to specify the passwords that are sent to this application for approved users, set the **Allow approvers to set user’s passwords for this application?** toggle to **Yes**.
62
+
7.**Optional:**To require business approval before users are allowed access, set the **Require approval before granting access to this application?** toggle to **Yes**.
73
63
74
-
12.**Optional:**To specify the business approvers who are allowed to approve access to this application, click the selector next to the label **Who is allowed to approve access to this application?**to select up to 10 individual business approvers.
64
+
8.**Optional: For applications using password single-sign on only,**to allow business approvers to specify the passwords that are sent to this application for approved users, set the **Allow approvers to set user’s passwords for this application?**toggle to **Yes**.
75
65
76
-
> [!NOTE]
77
-
> Groups are not supported.
78
-
>
79
-
>
66
+
9.**Optional:** To specify the business approvers who are allowed to approve access to this application, next to **Who is allowed to approve access to this application?**, click **Select approvers**, and then select up to 10 individual business approvers. Then click **Select**.
80
67
81
-
13.**Optional:****For applications which expose roles**, if you wish to assign self-service approved users to a role, click the selector next to the **To which role should users be assigned in this application?** to select the role to which these users should be assigned.
68
+
>[!NOTE]
69
+
>Groups are not supported. You can select up to 10 individual business approvers. If you specify multiple approvers, any single approver can approve an access request.
82
70
83
-
14. Click the **Save** button at the top of the blade to finish.
71
+
10.**Optional:****For applications that expose roles**, to assign self-service approved users to a role, next to the **To which role should users be assigned in this application?**, click **Select Role**, and then choose the role to which these users should be assigned. Then click **Select**.
84
72
85
-
Once you complete Self-service application configuration, users can navigate to their [Application Access Panel](https://myapps.microsoft.com/) and click the **+Add** button to find the apps to which you have enabled Self-service access. Business approvers also see a notification in their [Application Access Panel](https://myapps.microsoft.com/). You can enable an email notifying them when a user has requested access to an application that requires their approval.
73
+
11. Click the **Save** button at the top of the pane to finish.
86
74
87
-
These approvals support single approval workflows only, meaning that if you specify multiple approvers, any single approver may approver access to the application.
75
+
Once you complete Self-service application configuration, users can navigate to their [My Apps access panel](https://myapps.microsoft.com/) and click the **Add self-service apps** button to find the apps that are enable with self-service access. Business approvers also see a notification in their [My Apps access panel](https://myapps.microsoft.com/). You can enable an email notifying them when a user has requested access to an application that requires their approval.
88
76
89
77
## Next steps
90
78
[Setting up Azure Active Directory for self-service group management](../users-groups-roles/groups-self-service-management.md)
0 commit comments