You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/saas-apps/aws-single-sign-on-provisioning-tutorial.md
+32-30Lines changed: 32 additions & 30 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
-
title: 'Tutorial: Configure AWS Single Sign-On for automatic user provisioning with Azure Active Directory | Microsoft Docs'
3
-
description: Learn how to automatically provision and de-provision user accounts from Azure AD to AWS Single Sign-On.
2
+
title: 'Tutorial: Configure AWS IAM Identity Center (successor to AWS Single Sign-On) for automatic user provisioning with Azure Active Directory | Microsoft Docs'
3
+
description: Learn how to automatically provision and de-provision user accounts from Azure AD to AWS IAM Identity Center.
4
4
services: active-directory
5
5
documentationcenter: ''
6
6
author: twimmers
@@ -17,46 +17,48 @@ ms.date: 02/23/2021
17
17
ms.author: thwimmer
18
18
---
19
19
20
-
# Tutorial: Configure AWS Single Sign-On for automatic user provisioning
20
+
# Tutorial: Configure AWS IAM Identity Center (successor to AWS Single Sign-On) for automatic user provisioning
21
21
22
-
This tutorial describes the steps you need to perform in both AWS Single Sign-On and Azure Active Directory (Azure AD) to configure automatic user provisioning. When configured, Azure AD automatically provisions and de-provisions users and groups to [AWS Single Sign-On](https://console.aws.amazon.com/singlesignon) using the Azure AD Provisioning service. For important details on what this service does, how it works, and frequently asked questions, see [Automate user provisioning and deprovisioning to SaaS applications with Azure Active Directory](../app-provisioning/user-provisioning.md).
22
+
This tutorial describes the steps you need to perform in both AWS IAM Identity Center (successor to AWS Single Sign-On) and Azure Active Directory (Azure AD) to configure automatic user provisioning. When configured, Azure AD automatically provisions and de-provisions users and groups to [AWS IAM Identity Center](https://console.aws.amazon.com/singlesignon) using the Azure AD Provisioning service. For important details on what this service does, how it works, and frequently asked questions, see [Automate user provisioning and deprovisioning to SaaS applications with Azure Active Directory](../app-provisioning/user-provisioning.md).
23
23
24
24
25
25
## Capabilities Supported
26
26
> [!div class="checklist"]
27
-
> * Create users in AWS Single Sign-On
28
-
> * Remove users in AWS Single Sign-On when they no longer require access
29
-
> * Keep user attributes synchronized between Azure AD and AWS Single Sign-On
30
-
> * Provision groups and group memberships in AWS Single Sign-On
31
-
> *[Single Sign-On]() to AWS Single Sign-On
27
+
> * Create users in AWS IAM Identity Center
28
+
> * Remove users in AWS IAM Identity Center when they no longer require access
29
+
> * Keep user attributes synchronized between Azure AD and AWS IAM Identity Center
30
+
> * Provision groups and group memberships in AWS IAM Identity Center
31
+
> *[Single Sign-On](aws-single-sign-on-tutorial.md) to AWS IAM Identity Center
32
32
33
33
## Prerequisites
34
34
35
35
The scenario outlined in this tutorial assumes that you already have the following prerequisites:
36
36
37
37
*[An Azure AD tenant](../develop/quickstart-create-new-tenant.md)
38
38
* A user account in Azure AD with [permission](../roles/permissions-reference.md) to configure provisioning (for example, Application Administrator, Cloud Application administrator, Application Owner, or Global Administrator).
39
-
* A SAML connection from your Azure AD account to AWS SSO, as described in Tutorial
39
+
* A SAML connection from your Azure AD account to AWS IAM Identity Center, as described in Tutorial
40
40
41
41
## Step 1. Plan your provisioning deployment
42
42
1. Learn about [how the provisioning service works](../app-provisioning/user-provisioning.md).
43
43
2. Determine who will be in [scope for provisioning](../app-provisioning/define-conditional-rules-for-provisioning-user-accounts.md).
44
-
3. Determine what data to [map between Azure AD and AWS Single Sign-On](../app-provisioning/customize-application-attributes.md).
44
+
3. Determine what data to [map between Azure AD and AWS IAM Identity Center](../app-provisioning/customize-application-attributes.md).
45
45
46
-
## Step 2. Configure AWS Single Sign-On to support provisioning with Azure AD
46
+
## Step 2. Configure AWS IAM Identity Center to support provisioning with Azure AD
47
47
48
-
1. Open the [AWS SSO Console](https://console.aws.amazon.com/singlesignon).
48
+
1. Open the [AWS IAM Identity Center](https://console.aws.amazon.com/singlesignon).
49
49
50
50
2. Choose **Settings** in the left navigation pane
3.In **Settings**, click on Enable in the Automatic provisioning section.
53
53
54
-
4. In the Inbound automatic provisioning dialog box, copy and save the **SCIM endpoint** and **Access Token**. These values will be entered in the **Tenant URL** and **Secret Token** field in the Provisioning tab of your AWS Single Sign-On application in the Azure portal.
54
+
55
55
56
+
4. In the Inbound automatic provisioning dialog box, copy and save the **SCIM endpoint** and **Access Token** (visible after clicking on Show Token). These values will be entered in the **Tenant URL** and **Secret Token** field in the Provisioning tab of your AWS IAM Identity Center application in the Azure portal.
57
+
56
58
57
-
## Step 3. Add AWS Single Sign-On from the Azure AD application gallery
59
+
## Step 3. Add AWS IAM Identity Center from the Azure AD application gallery
58
60
59
-
Add AWS Single Sign-On from the Azure AD application gallery to start managing provisioning to AWS Single Sign-On. If you have previously setup AWS Single Sign-On for SSO, you can use the same application. Learn more about adding an application from the gallery [here](../manage-apps/add-application-portal.md).
61
+
Add AWS IAM Identity Center from the Azure AD application gallery to start managing provisioning to AWS IAM Identity Center. If you have previously setup AWS IAM Identity Center for SSO, you can use the same application. Learn more about adding an application from the gallery [here](../manage-apps/add-application-portal.md).
60
62
61
63
## Step 4. Define who will be in scope for provisioning
62
64
@@ -67,19 +69,19 @@ The Azure AD provisioning service allows you to scope who will be provisioned ba
67
69
* If you need additional roles, you can [update the application manifest](../develop/howto-add-app-roles-in-azure-ad-apps.md) to add new roles.
68
70
69
71
70
-
## Step 5. Configure automatic user provisioning to AWS Single Sign-On
72
+
## Step 5. Configure automatic user provisioning to AWS IAM Identity Center
71
73
72
74
This section guides you through the steps to configure the Azure AD provisioning service to create, update, and disable users and/or groups in TestApp based on user and/or group assignments in Azure AD.
73
75
74
-
### To configure automatic user provisioning for AWS Single Sign-On in Azure AD:
76
+
### To configure automatic user provisioning for AWS IAM Identity Center in Azure AD:
75
77
76
78
1. Sign in to the [Azure portal](https://portal.azure.com). Select **Enterprise Applications**, then select **All applications**.
5. Under the **Admin Credentials** section, input your AWS Single Sign-On **Tenant URL** and **Secret Token** retrieved earlier in Step 2. Click **Test Connection** to ensure Azure AD can connect to AWS Single Sign-On.
94
+
5. Under the **Admin Credentials** section, input your AWS IAM Identity Center **Tenant URL** and **Secret Token** retrieved earlier in Step 2. Click **Test Connection** to ensure Azure AD can connect to AWS IAM Identity Center.
@@ -99,9 +101,9 @@ This section guides you through the steps to configure the Azure AD provisioning
99
101
100
102
7. Select **Save**.
101
103
102
-
8. Under the **Mappings** section, select **Synchronize Azure Active Directory Users to AWS Single Sign-On**.
104
+
8. Under the **Mappings** section, select **Synchronize Azure Active Directory Users to AWS IAM Identity Center**.
103
105
104
-
9. Review the user attributes that are synchronized from Azure AD to AWS Single Sign-On in the **Attribute-Mapping** section. The attributes selected as **Matching** properties are used to match the user accounts in AWS Single Sign-On for update operations. If you choose to change the [matching target attribute](../app-provisioning/customize-application-attributes.md), you will need to ensure that the AWS Single Sign-On API supports filtering users based on that attribute. Select the **Save** button to commit any changes.
106
+
9. Review the user attributes that are synchronized from Azure AD to AWS IAM Identity Center in the **Attribute-Mapping** section. The attributes selected as **Matching** properties are used to match the user accounts in AWS IAM Identity Center for update operations. If you choose to change the [matching target attribute](../app-provisioning/customize-application-attributes.md), you will need to ensure that the AWS IAM Identity Center API supports filtering users based on that attribute. Select the **Save** button to commit any changes.
105
107
106
108
|Attribute|Type|Supported for Filtering|
107
109
|---|---|---|
@@ -131,9 +133,9 @@ This section guides you through the steps to configure the Azure AD provisioning
10. Under the **Mappings** section, select **Synchronize Azure Active Directory Groups to AWS Single Sign-On**.
136
+
10. Under the **Mappings** section, select **Synchronize Azure Active Directory Groups to AWS IAM Identity Center**.
135
137
136
-
11. Review the group attributes that are synchronized from Azure AD to AWS Single Sign-On in the **Attribute-Mapping** section. The attributes selected as **Matching** properties are used to match the groups in AWS Single Sign-On for update operations. Select the **Save** button to commit any changes.
138
+
11. Review the group attributes that are synchronized from Azure AD to AWS IAM Identity Center in the **Attribute-Mapping** section. The attributes selected as **Matching** properties are used to match the groups in AWS IAM Identity Center for update operations. Select the **Save** button to commit any changes.
137
139
138
140
|Attribute|Type|Supported for Filtering|
139
141
|---|---|---|
@@ -143,11 +145,11 @@ This section guides you through the steps to configure the Azure AD provisioning
143
145
144
146
12. To configure scoping filters, refer to the following instructions provided in the [Scoping filter tutorial](../app-provisioning/define-conditional-rules-for-provisioning-user-accounts.md).
145
147
146
-
13. To enable the Azure AD provisioning service for AWS Single Sign-On, change the **Provisioning Status** to **On** in the **Settings** section.
148
+
13. To enable the Azure AD provisioning service for AWS IAM Identity Center, change the **Provisioning Status** to **On** in the **Settings** section.
147
149
148
150
149
151
150
-
14. Define the users and/or groups that you would like to provision to AWS Single Sign-On by choosing the desired values in **Scope** in the **Settings** section.
152
+
14. Define the users and/or groups that you would like to provision to AWS IAM Identity Center by choosing the desired values in **Scope** in the **Settings** section.
@@ -196,9 +198,9 @@ There are two ways to resolve this
196
198
2. Remove the duplicate attributes. For example, having two different attributes being mapped from Azure AD both mapped to "phoneNumber___" on the AWS side would result in the error if both attributes have values in Azure AD. Only having one attribute mapped to a "phoneNumber____ " attribute would resolve the error.
197
199
198
200
### Invalid characters
199
-
Currently AWS SSO is not allowing some other characters that Azure AD supports like tab (\t), new line (\n), return carriage (\r), and characters such as " <|>|;|:% ".
201
+
Currently AWS IAM Identity Center is not allowing some other characters that Azure AD supports like tab (\t), new line (\n), return carriage (\r), and characters such as " <|>|;|:% ".
200
202
201
-
You can also check the AWS SSO troubleshooting tips [here](https://docs.aws.amazon.com/singlesignon/latest/userguide/azure-ad-idp.html#azure-ad-troubleshooting) for more troubleshooting tips
203
+
You can also check the AWS IAM Identity Center troubleshooting tips [here](https://docs.aws.amazon.com/singlesignon/latest/userguide/azure-ad-idp.html#azure-ad-troubleshooting) for more troubleshooting tips
Copy file name to clipboardExpand all lines: articles/azure-app-configuration/howto-best-practices.md
+4Lines changed: 4 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -102,6 +102,10 @@ When you use App Configuration in client applications, ensure that you consider
102
102
103
103
To address these concerns, we recommend that you use a proxy service between your client applications and your App Configuration store. The proxy service can securely authenticate with your App Configuration store without a security issue of leaking authentication information. You can build a proxy service by using one of the App Configuration provider libraries, so you can take advantage of built-in caching and refresh capabilities for optimizing the volume of requests sent to App Configuration. For more information about using App Configuration providers, see articles in Quickstarts and Tutorials. The proxy service serves the configuration from its cache to your client applications, and you avoid the two potential issues that are discussed in this section.
104
104
105
+
## Multitenant applications in App Configuration
106
+
107
+
A multitenant application is built on an architecture where a shared instance of your application serves multiple customers or tenants. For example, you may have an email service that offers your users separate accounts and customized experiences. Your application usually manages different configurations for each tenant. Here are some architectural considerations for [using App Configuration in a multitenant application](/azure/architecture/guide/multitenant/service/app-configuration).
108
+
105
109
## Configuration as Code
106
110
107
111
Configuration as code is a practice of managing configuration files under your source control system, for example, a git repository. It gives you benefits like traceability and approval process for any configuration changes. If you adopt configuration as code, App Configuration has tools to assist you in [managing your configuration data in files](./concept-config-file.md) and deploying them as part of your build, release, or CI/CD process. This way, your applications can access the latest data from your App Configuration store(s).
0 commit comments