You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Tutorial: Configure Workplace by Facebook for automatic user provisioning
22
22
23
-
The objective of this tutorial is to show you the steps you need to perform in Workplace by Facebook and Azure AD to automatically provision and de-provision user accounts from Azure AD to Workplace by Facebook.
23
+
This tutorial describes the steps you need to perform in both Workplace by Facebook and Azure Active Directory (Azure AD) to configure automatic user provisioning. When configured, Azure AD automatically provisions and de-provisions users and groups to [Workplace by Facebook](https://work.workplace.com/) using the Azure AD Provisioning service. For important details on what this service does, how it works, and frequently asked questions, see [Automate user provisioning and deprovisioning to SaaS applications with Azure Active Directory](../manage-apps/user-provisioning.md).
24
+
25
+
> [!NOTE]
26
+
> The Azure AD third party application in Workplace by Facebook has been approved. Customers will not have an interruption of service on December 16th. You will see a note in the Workplace by Facebook Admin console indicating a deadline of 28-February-2020 by when you will need to transition to the new application. We are working to keep the transition as simple as possible and will provide an update here on the transition by end of month.
27
+
28
+
## Capabilities supported
29
+
> [!div class="checklist"]
30
+
> * Create users in Workplace by Facebook
31
+
> * Remove users in Workplace by Facebook when they do not require access anymore
32
+
> * Keep user attributes synchronized between Azure AD and Workplace by Facebook
33
+
> *[Single sign-on](https://docs.microsoft.com/azure/active-directory/saas-apps/workplacebyfacebook-tutorial) to Workplace by Facebook (recommended)
24
34
25
35
## Prerequisites
26
36
27
-
To configure Azure AD integration with Workplace by Facebook, you need the following items:
37
+
The scenario outlined in this tutorial assumes that you already have the following prerequisites:
28
38
29
-
- An Azure AD subscription
30
-
- A Workplace by Facebook single-sign on enabled subscription
39
+
*[An Azure AD tenant](https://docs.microsoft.com/azure/active-directory/develop/quickstart-create-new-tenant)
40
+
* A user account in Azure AD with [permission](https://docs.microsoft.com/azure/active-directory/users-groups-roles/directory-assign-admin-roles) to configure provisioning (e.g. Application Administrator, Cloud Application administrator, Application Owner, or Global Administrator)
41
+
* A Workplace by Facebook single-sign on enabled subscription
31
42
32
43
> [!NOTE]
33
44
> To test the steps in this tutorial, we do not recommend using a production environment.
@@ -37,68 +48,119 @@ To test the steps in this tutorial, you should follow these recommendations:
37
48
- Do not use your production environment, unless it is necessary.
38
49
- If you don't have an Azure AD trial environment, you can get a one-month trial [here](https://azure.microsoft.com/pricing/free-trial/).
39
50
40
-
## Assigning users to Workplace by Facebook
51
+
## Step 1. Plan your provisioning deployment
52
+
1. Learn about [how the provisioning service works](https://docs.microsoft.com/azure/active-directory/manage-apps/user-provisioning).
53
+
2. Determine who will be in [scope for provisioning](https://docs.microsoft.com/azure/active-directory/manage-apps/define-conditional-rules-for-provisioning-user-accounts).
54
+
3. Determine what data to [map between Azure AD and Workplace by Facebook](https://docs.microsoft.com/azure/active-directory/manage-apps/customize-application-attributes).
41
55
42
-
Azure Active Directory uses a concept called "assignments" to determine which users should receive access to selected apps. In the context of automatic user account provisioning, only the users and groups that have been "assigned" to an application in Azure AD is synchronized.
56
+
## Step 2. Configure Workplace by Facebook to support provisioning with Azure AD
43
57
44
58
Before configuring and enabling the provisioning service, you need to decide what users and/or groups in Azure AD represent the users who need access to your Workplace by Facebook app. Once decided, you can assign these users to your Workplace by Facebook app by following the instructions here:
45
59
46
-
[Assign a user or group to an enterprise app](https://docs.microsoft.com/azure/active-directory/active-directory-coreapps-assign-user-azure-portal)
47
-
48
-
### Important tips for assigning users to Workplace by Facebook
49
-
50
60
* It is recommended that a single Azure AD user is assigned to Workplace by Facebook to test the provisioning configuration. Additional users and/or groups may be assigned later.
51
61
52
62
* When assigning a user to Workplace by Facebook, you must select a valid user role. The "Default Access" role does not work for provisioning.
53
63
54
-
## Enable User Provisioning
64
+
## Step 3. Add Workplace by Facebook from the Azure AD application gallery
55
65
56
-
This section guides you through connecting your Azure AD to Workplace by Facebook's user account provisioning API, and configuring the provisioning service to create, update, and disable assigned user accounts in Workplace by Facebook based on user and group assignment in Azure AD.
66
+
Add Workplace by Facebook from the Azure AD application gallery to start managing provisioning to Workplace by Facebook. If you have previously setup Workplace by Facebook for SSO you can use the same application. However it is recommended that you create a separate app when testing out the integration initially. Learn more about adding an application from the gallery [here](https://docs.microsoft.com/azure/active-directory/manage-apps/add-gallery-app).
57
67
58
-
>[!Tip]
59
-
>You may also choose to enable SAML-based Single Sign-On for Workplace by Facebook, following the instructions provided in [Azure portal](https://portal.azure.com). Single sign-on can be configured independently of automatic provisioning, though these two features compliment each other.
68
+
## Step 4. Define who will be in scope for provisioning
60
69
61
-
### To configure user account provisioning to Workplace by Facebook in Azure AD:
70
+
The Azure AD provisioning service allows you to scope who will be provisioned based on assignment to the application and or based on attributes of the user / group. If you choose to scope who will be provisioned to your app based on assignment, you can use the following [steps](../manage-apps/assign-user-or-group-access-portal.md) to assign users and groups to the application. If you choose to scope who will be provisioned based solely on attributes of the user or group, you can use a scoping filter as described [here](https://docs.microsoft.com/azure/active-directory/manage-apps/define-conditional-rules-for-provisioning-user-accounts).
62
71
63
-
The objective of this section is to outline how to enable provisioning of Active Directory user accounts to Workplace by Facebook.
72
+
* When assigning users and groups to Workplace by Facebook, you must select a role other than **Default Access**. Users with the Default Access role are excluded from provisioning and will be marked as not effectively entitled in the provisioning logs. If the only role available on the application is the default access role, you can [update the application manifest](https://docs.microsoft.com/azure/active-directory/develop/howto-add-app-roles-in-azure-ad-apps)to add additional roles.
64
73
65
-
Azure AD supports the ability to automatically synchronize the account details of assigned users to Workplace by Facebook. This automatic synchronization enables Workplace by Facebook to get the data it needs to authorize users for access, before them attempting to sign in for the first time. It also de-provisions users from Workplace by Facebook when access has been revoked in Azure AD.
74
+
* Start small. Test with a small set of users and groups before rolling out to everyone. When scope for provisioning is set to assigned users and groups, you can control this by assigning one or two users or groups to the app. When scope is set to all users and groups, you can specify an [attribute based scoping filter](https://docs.microsoft.com/azure/active-directory/manage-apps/define-conditional-rules-for-provisioning-user-accounts).
66
75
67
-
1.In the [Azure portal](https://portal.azure.com), browse to the **Azure Active Directory** > **Enterprise Apps** > **All applications** section.
76
+
1.Sign in to the [Azure portal](https://portal.azure.com). Select **Enterprise Applications**, then select **All applications**.
68
77
69
-
2. If you have already configured Workplace by Facebook for single sign-on, search for your instance of Workplace by Facebook using the search field. Otherwise, select **Add** and search for **Workplace by Facebook** in the application gallery. Select Workplace by Facebook from the search results, and add it to your list of applications.
5. Under the **Admin Credentials** section, enter the Access Token from your Workplace by Facebook administrator and set the Tenant URL value to `https://www.facebook.com/scim/v1/` . See these [instructions](https://developers.facebook.com/docs/workplace/integrations/custom-integrations/apps) on creating an Access Token for Workplace.
86
+
78
87
79
-
6. In the Azure portal, click **Test Connection** to ensure Azure AD can connect to your Workplace by Facebook app. If the connection fails, ensure your Workplace by Facebook account has Team Admin permissions.
88
+
4. Set the **Provisioning Mode** to **Automatic**.
80
89
81
-
7. Enter the email address of a person or group who should receive provisioning error notifications in the **Notification Email** field, and check the checkbox.
5. Under the **Admin Credentials** section, click on **Authorize**. You will be redirected to Workplace by Facebook's authorization page. Input your Workplace by Facebook username and click on the **Continue** button. Click **Test Connection** to ensure Azure AD can connect to Workplace by Facebook. If the connection fails, ensure your Workplace by Facebook account has Admin permissions and try again.
84
93
85
-
9. Under the Mappings section, select **Synchronize Azure Active Directory Users to Workplace by Facebook.**
10. In the **Attribute Mappings** section, review the user attributes that are synchronized from Azure AD to Workplace by Facebook. The attributes selected as **Matching** properties are used to match the user accounts in Workplace by Facebook for update operations. Select the Save button to commit any changes.
11. To enable the Azure AD provisioning service for Workplace by Facebook, change the **Provisioning Status** to **On** in the **Settings**section
98
+
6. In the **Notification Email** field, enter the email address of a person or group who should receive the provisioning error notifications and select the **Send an email notification when a failure occurs**check box.
For more information on how to configure automatic provisioning, see [https://developers.facebook.com/docs/facebook-at-work/provisioning/cloud-providers](https://developers.facebook.com/docs/facebook-at-work/provisioning/cloud-providers)
102
+
7. Select **Save**.
94
103
95
-
You can now create a test account. Wait for up to 20 minutes to verify that the account has been synchronized to Workplace by Facebook.
104
+
8. Under the **Mappings** section, select **Synchronize Azure Active Directory Users to Workplace by Facebook**.
96
105
97
-
> [!NOTE]
98
-
> The Azure AD third party application in Workplace by Facebook has been approved. Customers will not have an interruption of service on December 16th. You will see a note in the Workplace by Facebook Admin console indicating a deadline of 28-February-2020 by when you will need to transition to the new application. We are working to keep the transition as simple as possible and will provide an update here on the transition by end of month.
106
+
9. Review the user attributes that are synchronized from Azure AD to Workplace by Facebook in the **Attribute-Mapping** section. The attributes selected as **Matching** properties are used to match the user accounts in Workplace by Facebook for update operations. If you choose to change the [matching target attribute](https://docs.microsoft.com/azure/active-directory/manage-apps/customize-application-attributes), you will need to ensure that the Workplace by Facebook API supports filtering users based on that attribute. Select the **Save** button to commit any changes.
10. To configure scoping filters, refer to the following instructions provided in the [Scoping filter tutorial](../manage-apps/define-conditional-rules-for-provisioning-user-accounts.md).
134
+
135
+
11. To enable the Azure AD provisioning service for Workplace by Facebook, change the **Provisioning Status** to **On** in the **Settings** section.
136
+
137
+
138
+
139
+
12. Define the users and/or groups that you would like to provision to Workplace by Facebook by choosing the desired values in **Scope** in the **Settings** section.
This operation starts the initial synchronization cycle of all users and groups defined in **Scope** in the **Settings** section. The initial cycle takes longer to perform than subsequent cycles, which occur approximately every 40 minutes as long as the Azure AD provisioning service is running.
148
+
149
+
## Step 6. Monitor your deployment
150
+
Once you've configured provisioning, use the following resources to monitor your deployment:
151
+
152
+
1. Use the [provisioning logs](https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-provisioning-logs) to determine which users have been provisioned successfully or unsuccessfully
153
+
2. Check the [progress bar](https://docs.microsoft.com/azure/active-directory/manage-apps/application-provisioning-when-will-provisioning-finish-specific-user) to see the status of the provisioning cycle and how close it is to completion
154
+
3. If the provisioning configuration seems to be in an unhealthy state, the application will go into quarantine. Learn more about quarantine states [here](https://docs.microsoft.com/azure/active-directory/manage-apps/application-provisioning-quarantine-status).
155
+
156
+
## Troubleshooting tips
157
+
* If you see a user unsuccessfully created and there is an audit log event with the code "1789003" it means that the user is from an unverified domain.
99
158
100
159
## Additional resources
101
160
102
-
*[Managing user account provisioning for Enterprise Apps](tutorial-list.md)
161
+
*[Managing user account provisioning for Enterprise Apps](../manage-apps/configure-automatic-user-provisioning-portal.md)
103
162
*[What is application access and single sign-on with Azure Active Directory?](../manage-apps/what-is-single-sign-on.md)
104
-
*[Configure Single Sign-on](workplacebyfacebook-tutorial.md)
163
+
164
+
## Next steps
165
+
166
+
*[Learn how to review logs and get reports on provisioning activity](../manage-apps/check-status-user-account-provisioning.md)
0 commit comments