You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/saas-apps/harness-provisioning-tutorial.md
+70-62Lines changed: 70 additions & 62 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: 'Tutorial: Configure Harness for automatic user provisioning with Azure Active Directory | Microsoft Docs'
3
-
description: Learn how to configure Azure Active Directory to automatically provision and de-provision user accounts to Harness.
3
+
description: Learn how to configure Azure Active Directory to automatically provision and deprovision user accounts to Harness.
4
4
services: active-directory
5
5
documentationcenter: ''
6
6
author: zchia
@@ -20,151 +20,159 @@ ms.author: Zhchia
20
20
21
21
# Tutorial: Configure Harness for automatic user provisioning
22
22
23
-
The objective of this tutorial is to demonstrate the steps to be performed in Harness and Azure Active Directory (Azure AD) to configure Azure AD to automatically provision and de-provision users and/or groups to Harness.
23
+
In this article, you learn how to configure Azure Active Directory (Azure AD) to automatically provision and deprovision users or groups to Harness.
24
24
25
25
> [!NOTE]
26
-
> This tutorial describes a connector built on top of the Azure AD User Provisioning Service. For important details on what this service does, how it works, and frequently asked questions, see [Automate user provisioning and deprovisioning to SaaS applications with Azure Active Directory](../manage-apps/user-provisioning.md).
26
+
> This article describes a connector that's built on top of the Azure AD user provisioning service. For important information about this service and answers to frequently asked questions, see [Automate user provisioning and deprovisioning to SaaS applications with Azure Active Directory](../manage-apps/user-provisioning.md).
27
27
>
28
-
> This connector is currently in Public Preview. For more information on the general Microsoft Azure terms of use for Preview features, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
28
+
> This connector is currently in preview. For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
29
29
30
30
## Prerequisites
31
31
32
-
The scenario outlined in this tutorial assumes that you already have the following prerequisites:
32
+
The scenario outlined in this article assumes that you already have the following prerequisites:
33
33
34
34
* An Azure AD tenant
35
35
*[A Harness tenant](https://harness.io/pricing/)
36
-
* A user account in Harness with Admin permissions.
36
+
* A user account in Harness with *Admin* permissions
37
37
38
-
## Assigning users to Harness
38
+
## Assign users to Harness
39
39
40
-
Azure Active Directory uses a concept called *assignments* to determine which users should receive access to selected apps. In the context of automatic user provisioning, only the users and/or groups that have been assigned to an application in Azure AD are synchronized.
40
+
Azure Active Directory uses a concept called *assignments* to determine which users should receive access to selected apps. In the context of automatic user provisioning, only the users or groups that have been assigned to an application in Azure AD are synchronized.
41
41
42
-
Before configuring and enabling automatic user provisioning, you should decide which users and/or groups in Azure AD need access to Harness. Once decided, you can assign these users and/or groups to Harness by following the instructions here:
43
-
*[Assign a user or group to an enterprise app](../manage-apps/assign-user-or-group-access-portal.md)
42
+
Before you configure and enable automatic user provisioning, decide which users or groups in Azure AD need access to Harness. You can then assign these users or groups to Harness by following the instructions in [Assign a user or group to an enterprise app](../manage-apps/assign-user-or-group-access-portal.md).
44
43
45
44
## Important tips for assigning users to Harness
46
45
47
-
*It is recommended that a single Azure AD user is assigned to Harness to test the automatic user provisioning configuration. Additional users and/or groups may be assigned later.
46
+
*We recommended that you assign a single Azure AD user to Harness to test the automatic user provisioning configuration. Additional users or groups can be assigned later.
48
47
49
-
* When assigning a user to Harness, you must select any valid application-specific role (if available) in the assignment dialog. Users with the **Default Access** role are excluded from provisioning.
48
+
* When you assign a user to Harness, you must select any valid application-specific role (if available) in the **Assignment** dialog box. Users with the *Default Access* role are excluded from provisioning.
50
49
51
50
## Set up Harness for provisioning
52
51
53
-
1. Sign in to your [Harness Admin Console](https://app.harness.io/#/login). Navigate to **Continuous Security > Access Management**.
52
+
1. Sign in to your [Harness Admin Console](https://app.harness.io/#/login), and then go to **Continuous Security** > **Access Management**.
60
59
61
-
3. Click on **Add New Key**. In the **Add Api Key** dialog box, provide a **Name** and select an option from **Permissions Inherited from** dropdown menu. Click on **Submit** button.
60
+
1. Select **Add API Key**.
62
61
63
-
62
+
64
63
65
-
64
+
1. In the **Add Api Key** pane, do the following:
66
65
67
-
3. Copy the **Key**. This value will be entered in the Secret Token field in the Provisioning tab of your Harness application in the Azure portal.
66
+
67
+
68
+
a. In the **Name** box, provide a name for the key.
69
+
b. In the **Permissions Inherited from** drop-down list, select an option.
70
+
71
+
1. Select **Submit**.
72
+
73
+
1. Copy the **Key** for later use in this tutorial.
Before configuring Harness for automatic user provisioning with Azure AD, you need to add Harness from the Azure AD application gallery to your list of managed SaaS applications.
74
-
75
-
**To add Harness from the Azure AD application gallery, perform the following steps:**
79
+
Before you configure Harness for automatic user provisioning with Azure AD, you need to add Harness from the Azure AD application gallery to your list of managed SaaS applications.
76
80
77
-
1. In the **[Azure portal](https://portal.azure.com)**, in the left navigation panel, select **Azure Active Directory**.
81
+
1. In the [Azure portal](https://portal.azure.com), in the left pane, select **Azure Active Directory**.
78
82
79
-
83
+
80
84
81
-
2. Go to **Enterprise applications**, and then select**All applications**.
84
88
85
-
3. To add a new application, select the **New application** button at the top of the pane.
89
+
1. To add a new application, select the **New application** button at the top of the pane.
86
90
87
-
91
+
88
92
89
-
4. In the search box, enter **Harness**, select **Harness** in the results panel, and then click the **Add** button to add the application.
93
+
1. In the search box, enter **Harness**, select **Harness** in the results list, and then select the **Add** button to add the application.
90
94
91
95
92
96
93
-
## Configuring automatic user provisioning to Harness
97
+
## Configure automatic user provisioning to Harness
94
98
95
-
This section guides you through the steps to configure the Azure AD provisioning service to create, update, and disable users and/or groups in Harness based on user and/or group assignments in Azure AD.
99
+
This section guides you through the steps to configure the Azure AD provisioning service to create, update, and disable users or groups in Harness based on user or group assignments in Azure AD.
96
100
97
101
> [!TIP]
98
-
> You may also choose to enable SAML-based single sign-on for Harness by following the instructions provided in the [Harness Single sign-on tutorial](https://docs.microsoft.com/azure/active-directory/saas-apps/harness-tutorial). Single sign-on can be configured independently of automatic user provisioning, although these two features complement each other
102
+
> You may also choose to enable SAML-based single sign-on for Harness by following the instructions in the [Harness single sign-on tutorial](https://docs.microsoft.com/azure/active-directory/saas-apps/harness-tutorial). You can configure single sign-on independent of automatic user provisioning, although these two features complement each other.
99
103
100
104
> [!NOTE]
101
-
> To learn more about Harness' SCIM endpoint, refer [this](https://docs.harness.io/article/smloyragsm-api-keys)
105
+
> To learn more about the Harness SCIM endpoint, see the Harness [API Keys](https://docs.harness.io/article/smloyragsm-api-keys) article.
102
106
103
-
### To configure automatic user provisioning for Harness in Azure AD:
107
+
To configure automatic user provisioning for Harness in Azure AD, do the following:
104
108
105
-
1.Sign in to the [Azure portal](https://portal.azure.com). Select**Enterprise Applications**, then select**All applications**.
109
+
1.In the [Azure portal](https://portal.azure.com), select**Enterprise Applications** >**All applications**.
5. Under the **Admin Credentials** section, input `https://app.harness.io/gateway/api/scim/account/XCPzWkCIQ46ypIu2DeT7yw` in **Tenant URL**. Input the **SCIM Authentication Token** value retrieved earlier in **Secret Token**. Click **Test Connection** to ensure Azure AD can connect to Harness. If the connection fails, ensure your Harness account has Admin permissions and try again.
a. In the **Tenant URL** box, enter **`https://app.harness.io/gateway/api/scim/account/XCPzWkCIQ46ypIu2DeT7yw`**.
130
+
b. In the **Secret Token** box, enter the SCIM Authentication Token value that you saved in step 6 of the "Set up Harness for provisioning" section.
131
+
c. Select **Test Connection** to ensure that Azure AD can connect to Harness. If the connection fails, ensure that your Harness account has *Admin* permissions, and then try again.
124
132
125
-
6. In the **Notification Email**field, enter the email address of a person or group who should receive the provisioning error notifications and check the checkbox - **Send an email notification when a failure occurs**.
133
+
1. In the **Notification Email**box, enter the email address of a person or group that should receive the provisioning error notifications, and then select the **Send an email notification when a failure occurs** check box.
8. Under the **Mappings** section, select **Synchronize Azure Active Directory Users to Harness**.
139
+
1. Under **Mappings**, select **Synchronize Azure Active Directory Users to Harness**.
132
140
133
-
141
+
134
142
135
-
9. Review the user attributes that are synchronized from Azure AD to Harness in the **Attribute Mapping** section. The attributes selected as **Matching** properties are used to match the user accounts in Harness for update operations. Select the **Save** button to commit any changes.
143
+
1. Under **Attribute Mappings**, review the user attributes that are synchronized from Azure AD to Harness. The attributes selected as *Matching*are used to match the user accounts in Harness for update operations. Select **Save** to commit any changes.
136
144
137
-
145
+
138
146
139
-
10. Under the **Mappings** section, select **Synchronize Azure Active Directory Groups to Harness**.
147
+
1. Under **Mappings**, select **Synchronize Azure Active Directory Groups to Harness**.
140
148
141
-
149
+
142
150
143
-
11. Review the group attributes that are synchronized from Azure AD to Harness in the **Attribute Mapping** section. The attributes selected as **Matching** properties are used to match the groups in Harness for update operations. Select the **Save** button to commit any changes.
151
+
1. Under **Attribute Mappings**, review the group attributes that are synchronized from Azure AD to Harness. The attributes selected as *Matching* properties are used to match the groups in Harness for update operations. Select **Save** to commit any changes.
144
152
145
-
153
+
146
154
147
-
12. To configure scoping filters, refer to the following instructions provided in the [Scoping filter tutorial](../manage-apps/define-conditional-rules-for-provisioning-user-accounts.md).
155
+
1. To configure scoping filters, see [Attribute-based application provisioning with scoping filters](../manage-apps/define-conditional-rules-for-provisioning-user-accounts.md).
148
156
149
-
13. To enable the Azure AD provisioning service for Harness, change the **Provisioning Status** to **On** in the **Settings** section.
157
+
1. Under **Settings**, to enable the Azure AD provisioning service for Harness, toggle the **Provisioning Status**switch to **On**.
150
158
151
-
159
+
152
160
153
-
14. Define the users and/or groups that you would like to provision to Harness by choosing the desired values in **Scope** in the **Settings** section.
161
+
1. Under **Settings**, in the **Scope** drop-down list, select how you want to sync the users or groups that you're provisioning to Harness.
160
168
161
-
This operation starts the initial synchronization of all users and/or groups defined in **Scope** in the **Settings** section. The initial sync takes longer to perform than subsequent syncs, which occur approximately every 40 minutes as long as the Azure AD provisioning service is running. You can use the **Synchronization Details** section to monitor progress and follow links to provisioning activity report, which describes all actions performed by the Azure AD provisioning service on Harness.
169
+
This operation starts the initial sync of the users or groups you're provisioning. The initial sync takes longer to perform than later ones. Syncs occur approximately every 40 minutes, as long as the Azure AD provisioning service is running. To monitor progress, go to the **Synchronization Details** section. You can also follow links to a provisioning activity report, which describes all actions performed by the Azure AD provisioning service on Harness.
162
170
163
-
For more information on how to read the Azure AD provisioning logs, see [Reporting on automatic user account provisioning](../manage-apps/check-status-user-account-provisioning.md).
171
+
For more information about how to read the Azure AD provisioning logs, see [Report on automatic user account provisioning](../manage-apps/check-status-user-account-provisioning.md).
164
172
165
173
## Additional resources
166
174
167
-
*[Managing user account provisioning for Enterprise Apps](../manage-apps/configure-automatic-user-provisioning-portal.md)
175
+
*[Manage user account provisioning for enterprise apps](../manage-apps/configure-automatic-user-provisioning-portal.md)
168
176
*[What is application access and single sign-on with Azure Active Directory?](../manage-apps/what-is-single-sign-on.md)
0 commit comments