Introduction

This guide provides information on how to:

• Set up Beyond Identity as a passwordless authentication solution for your Hybrid Azure AD Environment.
• Set up Active Directory and Azure AD to use Beyond Identity as an Identity Provider.
• Set up Beyond Identity Admin Console and User Console applications in Azure AD.
• Set up SCIM based provisioning from Azure AD to Beyond Identity Cloud.

 

Prerequisites

Ensure that you have the following:

1. An Active Directory Admin Account with “Enterprise Administrator” privileges to:
   1. Configure Groups and Alternative Domain Name
2. An Azure AD Connect “Administrator” account to
   1. Configure Azure AD Connect
3. An Azure Active Directory Admin Account with “Global Administrator” privileges to:
   1. Configure “Beyond Identity Admin Console” and “Beyond Identity User Console” Applications
   2. Set up SCIM based provisioning from Azure AD to Beyond Identity Cloud
4. Hybrid Identity Deployment with Active Directory, Azure AD Connect, and Azure AD.
5. An alternative domain name to be used during the Beyond Identity test phase. The alternative domain name must be a top-level domain and not a subdomain. (e.g., for contoso.com as a primary domain, use contoso.org as an alternative domain) You will need access to that domain’s DNS settings to verify the domain in Azure AD.
6. A Windows machine with “Administrator” privileges and powershell module (MSOnline) to:
   1. Set up the Domain for federated authentication.
7. An Office365 “Administrator” account to:
   1. Setup Office365 mailbox accounts.

 

Beyond Identity Configuration

Information to provide to the Beyond Identity Field Team:

 

Information you will receive from the Beyond Identity Field Team

 

Alternative Domain Configuration

Beyond Identity recommends that you use an alternative domain during the test phase.

First choose a domain to be used. If you already have a spare domain, use that. Otherwise, go to any Domain Registrar and purchase a new domain.

Follow the steps explained here to add this domain as a Custom Domain in the Azure Portal.

https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add-custom-domain

Active Directory Configuration

To configure Beyond Identity as the Federated IdP in Active Directory, follow the steps below. Once these steps are taken, you will be ready to enable Beyond Identity for test users.

Section 1-A: Set up Active Directory Groups (Optional, use if groups are synced from AD to AAD)

Beyond Identity service assignment is required for IT Admin and End Users. The following steps describe how to create BI_Admins, BI_Users and BI_Push_Groups groups and assign users to those groups, if groups are synced from AD to AAD.

1. Log in to Active Directory or other domain servers as Enterprise Administrator.
2. Start “Server Manager” Application and click on “Tools” menu in the top right corner.
3. Select “Active Directory Users and Computers”.
4. In the “Active Directory Users and Computers” window, right click on “Users” and select New -> Group.
5. Create a new Admins group by selecting the following parameters.
   1. Group Name: BI_Admins
   2. Group Scope: Global
   3. Group Type: Security
   4. Click on “OK” to create this group.
6. Double Click on “BI_Admins” group and click on “Members” tab.
   1. Click on Add.
   2. In the “Enter the Object names to select”, enter UPN for the Admin.
   3. Click OK.
7. In the “Active Directory Users and Computers” window, right click on “Users” and select New -> Group.
8. Create a new Users group by selecting the following parameters.
   1. Group Name: BI_Users
   2. Group Scope: Global
   3. Group Type: Security
   4. Click on “OK” to create this group.
9. Double Click on “BI_Users” group and click on “Members” tab.
   1. Click on Add.
   2. In the “Enter the Object names to select”, enter UPN for the Users.
   3. Click OK.
10. In the “Active Directory Users and Computers” window, right click on “Users” and select New -> Group.
11. Create a new Users group by selecting following parameters
    1. Group Name: BI_Push_Groups
    2. Group Scope: Global
    3. Group Type: Security
    4. Click on “OK” to create this group.
12. Double Click on “BI_Push_Groups” group and click on “Members” tab.
    1. Click on Add.
    2. In the “Enter the Object names to select”, enter groups you would like to define policies for.
    3. Click OK.

*** Ensure that all users have FirstName, LastName, DisplayName and an email added ***

 

13. Run delta sync command to synchronize newly created groups to AAD.

 

Section 1-B: Set up Azure Active Directory Groups (Optional, use if groups are managed in Azure AD)

Beyond Identity service assignment is required for IT Admin and End Users. The following steps describe how to create BI_Admins, BI_Users and BI_Push_Groups Group and assign users or groups to those groups, if groups are managed in Azure AD.

1. Log in to the Azure Portal (portal.azure.com) as “Global Administrator”.
2. Click on “Azure Active Directory” logo or search “Azure Active Directory” from the “Home” screen.
3. Click on “Groups” from the left menu bar.
4. Click on “New group” from top menu bar with following parameters:
   1. Group Type: Security
   2. Group Name: BI_Admins
   3. Group Description: Beyond Identity Admins
   4. Membership type: Assigned
   5. Click on “Create” button to create this group.
5. Right Click on “BI_Admins” group and click on “Members”.
   1. Click on “Add Members” from the top menu.
   2. Search members to be added using UPN and click on their names to select that user.
   3. Click on “Select” to add selected users.
6. From the “Azure Active Directory” home page, click on “Groups” in left menu bar and click on Click on “New group” from top menu bar with following parameters:
   1. Group Type: Security
   2. Group Name: BI_Users
   3. Group Description: Beyond Identity Users
   4. Membership type: Assigned
   5. Click on “Create” button to create this group.
7. Right Click on “BI_Users” group and click on “Members”.
   1. Click on “Add Members” from the top menu.
   2. Search members to be added using UPN and click on their names to select the user.
   3. Click on “Select” to add selected users.
8. From the “Azure Active Directory” home page, click on “Groups” in left menu bar and click on Click on “New group” from top menu bar with following parameters:
   1. Group Type: Security
   2. Group Name: BI_Push_Groups
   3. Group Description: Groups used for policy in Beyond Identity
   4. Membership type: Assigned
   5. Click on “Create” button to create this group.
9. Right Click on “BI_Push_Groups” group and click on “Members”.
   1. Click on “Add Members” from the top menu.
   2. Search members to be added using group name and click on their names to select the group to be pushed to Beyond Identity.
   3. Click on “Select” to add selected groups.

 

*** Ensure that all users have FirstName, LastName, DisplayName and an email added ***

 

Section 2: Set up Alternative Domain Name for use during testing

The steps below provide an example domain configuration for the “contoso.com” configured with “contoso.org” as an alternative domain. 

 

1. Log in to Active Directory or other domain servers as “Enterprise Administrator”.
2. Start “Server Manager” Application and click on “Tools” menu in the top right corner.
   
   
3. Select “Active Directory Domains and Trusts”.
   
   
4. In “Active Directory Domains and Trusts” window, right click on “Active Directory Domains and Trusts” and select “Properties”.
   
   
5. Add alternative UPN Suffix (e.g., contoso.org) on “UPN Suffixes” tab.
   
   

6. Click on “Apply” and “OK”.
7. Run delta sync command to synchronize newly created Alternative UPN.

Section 3: Setup Beyond Identity Admin Console in Azure AD

1. Log in to Azure Portal as “Global Administrator”.
2. Click on “Azure Active Directory” logo or search “Azure Active Directory” from the “Home” screen.
3. Click on “Enterprise Applications” from the left menu bar.
4. Click on “New Application” from the top menu bar.
5. Search for “Beyond Identity” from the top menu bar and select “Beyond Identity Admin Console” App from the App Gallery. Click on “Create” to instantiate this app.
   
   
6. From the Home -> Tenant Name -> Enterprise Applications -> “Beyond Identity Admin Console” application page.
   1. Click on “Owners” from the left side menu and then click on “Add” from the top menu. Search for users using UPN and click them to select the users. Click on the “Select” button to make selected users as the Owner.
   2. Click on “Users and groups” from the left side menu and then click on “Add user/group” and then select “BI_Admins” group. Click on “Assign”.
7. From the Home -> Tenant Name -> Enterprise Applications -> “Beyond Identity Admin Console” application page.
   1. Follow steps 1-4, in “Section 4: Setup Admin Portal Access Authentication using SSO” and record SAML Connection ID from Beyond Identity Admin Console and return to perform following steps.
   2. Click on “Single Sign-on” from the left side menu and then click on “SAML” as a single sign-on method.
   3. On the “Set up Single Sign-on with SAML” page click “Edit” on “Basic SAML Configuration” and make following changes (using the values provided by the Beyond Identity SE).
      1. Identifier (Entity ID):* https://admin.byndid.com/auth/saml/<connection-id>/sso/metadata.xml 
      2. Reply URL (ACS URL): https://admin.byndid.com/auth/saml/<connection-id>/sso
      3. Mark newly added “Entity ID” and “Reply URL” as default.
      4. Delete “Sample Entity ID”.
      5. Click on the “Save” button.
      6. Close the configuration dialog box by clicking X.
   4. On the “Set up Single Sign-on with SAML” page in the “SAML Signing Certificate” section, click on “Download” for “Certificate (Base64)”.

If the Certificate is not available for download, click on “Edit”, “New Certificate, “Save”, then click on “Download” for “Certificate (Base64)”.

5. Record following URLs from the “Set up Single Sign-on with SAML” page in “Set up Beyond Identity Admin Console” section. You will need this in the next section.
   1. Login URL
   2. Azure AD Identifier

 

Section 4: Setup Admin Portal Access Authentication using SSO 

1. Login to Beyond Identity Admin Console by visiting https://admin.byndid.com and click on “Log in with Beyond Identity”.
2. Once logged into Admin Console click on Settings.
3. On the Settings page, click on the Console Login tab.
4. In the “Admin Console SSO Integrations” section click on “Edit SSO” for the Custom SAML SSO section  and configure the following parameters.

1. Record the ID field and use it in the previous section as Connection-ID. 

5. In the “Admin Console SSO Integrations” section click on “Edit SSO” for the Custom SAML SSO section  and configure the following parameters.

1. Name: Admin Console SSO - Azure
2. IDP Url: https://login.microsoftonline.com/<azure-tenant-id>/saml2 (Use the value recorded in the previous step)
3. IDP Entity ID: https://sts.windows.net/<azure-tenant-id>/ (Use the value recorded in the previous step)
4. Name ID Format: emailAddress 
5. Subject User Attribute: UserName
6. Request Binding: http redirect
7. X509 Signing Certificate: Upload certificate file downloaded in the previous step.

6. After these values are provisioned, login to Beyond Identity Admin Console using SSO and confirm that the admin (user from the BI_Admins group) has access to the Beyond Identity Admin Console.

 

Section 5: Setup Beyond Identity User Console in Azure AD

1. Log in to the Azure Portal as “Global Administrator”.
2. Click on “Azure Active Directory” logo or search “Azure Active Directory” from the “Home” screen.
3. Click on “Enterprise Applications” from the left menu bar.
4. Click on “New Application” from the top menu bar.
5. Click on “Create your own application” from the top menu bar.
6. Enter following parameters on “Create your own application” page:
   1. Name: “Beyond Identity User Console”
   2. For “What are you looking to do with your application?”, select “Integrate any other application you don't find in the gallery (Non-gallery)”
   3. Click on “Create”.
7. From the Home -> Tenant-Name -> Enterprise Applications -> Beyond Identity User Console -> Properties page upload the Beyond Identity logo. (Optional: This helps in Identifying BI Apps easily).
8. From the Home -> Tenant-Name -> Enterprise Applications -> Beyond Identity User Console -> Owners page
   1. Click on “Add” from the top menu. Search for users using UPN and click them to select the users. Click on “Select” button to make selected users as the Owner.
9. From the Home -> Tenant-Name -> Enterprise Applications -> Beyond Identity User Console application page:
   1. Click on “Single Sign-on” from the left side menu and then select “Linked”. In the “Sign-On URL”, add:

https://user.byndid.com/auth-user/?org_id=<BI_Tenant_Name>

10. From the Home -> Tenant-Name -> Enterprise Applications -> Beyond Identity User Console -> Provisioning page:
    1. Provisioning Mode: Select “Automatic”.
    2. On the “Admin Credentials” Tab:
       1. Tenant URL: https://api.byndid.com/scim/v2
       2. Secret Token: <Beyond Identity SE will provide the Tenant API token>
       3. Click on “Test Connection”. 
       4. After successful SCIM connection test, click on “Save”.
    3. On the “Mappings” Tab
       1. Ensure “Provisioning Azure Active Directory Groups” is enabled.
       2. Ensure “Provisioning Azure Active Directory Users” is enabled.
    4. On the “Settings” Tab
       1. Select “Send an email notification when a failure occurs” and provide a valid email address for IT admin.
       2. Scope: “Sync only assigned users and groups”
       3. Click on “Save”.
       4. Provisioning Status: On
11. From the Home -> Tenant-Name -> Enterprise Applications -> Beyond Identity User Console -> Provisioning page:
    1. Click on “Update Credentials”
    2. Set “Provisioning Status”: On
    3. Click on “Save”.
12. From the Home -> Tenant-Name -> Enterprise Applications -> Beyond Identity User Console -> Provisioning page:
    1. Click on “Edit Attribute Mappings”.
    2. Click on the “Provision Azure Active Directory Users” link.
    3. Ensure “Target Object Actions” has “Create”, “Update” and “Delete” enabled.
    4. Select “Show Advanced Options” and click on “Edit Attribute list for customappsso” to ensure following settings:
       1. id: Primary key, Required Set
       2. active: Required
       3. displayName: Required
       4. emails (work): Required, Multi-Value
       5. username: Required
       6. name.givenName: Required
       7. name.familyName: Required
       8. externalId: Required
       9. Click on “Save”.
    5. On the “Attribute Mappings” list, keep only the following 7 attributes and delete the rest. Also, if any of the below attributes is missing, add it manually.
       1. username
       2. active
       3. displayName
       4. emails (work)
       5. name.givenName
       6. name.familyName
       7. externalId
          
          

 

6. On the “Attribute Mappings” list, click on the entry for the externalId (click on the left hand side portion of the entry) and update as following:
   1. Mapping Type: Expression
   2. Expression: Switch(IsPresent([immutableId]),[userPrincipalName], "True", [immutableId])
   3. Leave other fields as default and click on “OK”.
   4. On the “Provisioning” page, click on “Save”.

13. From the Home -> Tenant-Name -> Enterprise Applications -> Beyond Identity User Console application page.
    1. Click on “Users and groups” from the left side menu and then click on “Add user/group” and then select “BI_Users” and “BI_Push_Groups” group. Click on “Assign”.
14. In the top search bar, search for “App registrations”, then click on “All Applications”, then select “Beyond Identity User Console”.
    1. From the “Overview” page, note down “Application (client) ID”. This will be required in later steps.
    2. From the “Overview” page, note down “Directory (tenant) ID”. This will be required in later steps.
    3. From the “Authentication” page under Platform Configuration -> Add a platform and Select “Web” and enter:
       1. Redirect URI: https://user.byndid.com/auth-user/callback
       2. Implicit grant and hybrid flows: Select “ID Tokens”
       3. Support Account Type: “Accounts in this organizational directory only (Single Tenant)”
       4. Under “Advanced Settings” for “Allow public client flows” select “No”.
       5. Click on “Save”.
15. Navigate to the “Beyond Identity User Console” App page under “App Registrations” and

click on “Certificates and Secrets”.

1. Under the “Client Secrets” section click on “New client secret”.
2. On the “Add a client secret” page, update the “Description” field with “Beyond Identity User Console” and set the “Expires” field to “24 Months”.
3. Copy the Client Secret from the “Value” column. This will be required in later steps.

16. No changes required to the “Token Configuration” page.
17. Navigate to the “Beyond Identity user Console” App page under App Registrations and click on “API permissions”.
    1. Click on “Add a Permission”. 
    2. Select “Microsoft Graph APIs”.
    3. Select “Delegated Permissions”.
    4. Select OpendID permissions and then select “email”, “offline_access”, “openid”, and “profile”.
    5. Click on “Add Permissions”.
    6. Click on “Grant admin Consent for <Tenant Name>” and then click on “Yes” to grant consent.
18. No changes required to “Expose an API” page.
19. No changes required to “App Roles” page.

 

Section 6: Setup Beyond Identity User Console:

1. Once logged into Beyond Identity Admin Console, click on Account Settings.
   
   

 

2. Click on “User Portal” tab and click on “Edit SSO” for OIDC SSO.
3. Edit SSO fields according to following steps and as explained diagram:
   1. Name: <Name of the SSO>
   2. Client ID: <Use the value recorded in the previous step>
   3. Client Secret: <Use the value recorded in the previous step>
   4. Issuer: https://sts.windows.net/<Azure-AD-Tenant-ID>/ (Remember to add the trailing slash)
   5. Token Field: upn
   6. Token Field Lookup: user name
      
      

4. After these values are provisioned, login and confirm that the user has access to Beyond Identity User Console. (If this step fails, use “provision on demand” steps to provision the user in Beyond Identity first)

Section 7: Setup Beyond Identity Console for User Authentication (WS-FED federation):

1. Once logged into Beyond Identity Admin Console UI, click on the “Integrations” tab and then click on “WS-FED” tab.
2. Click on “Add WS-FED Connection” and update the fields as following:
   1. Name: Azure WS-FED
   2. SP Single Sign on URL: https://login.microsoftonline.com/login.srf
   3. SP Audience URI: https://login.microsoftonline.com/<Azure-AD-Tenant-ID>/
   4. Name ID Format: Unspecified
   5. Subject User Attribute: ExternalID
   6. Authentication Context Class: X509
   7. Attribute Claims: Name: ImmutableID, Name format: unspecified, Value: {{ExternalID}}, Name space: http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID 
   8. Attribute Claims: Name: emailaddress, Name format: unspecified, Value: {{Email}}, Name space: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress 
   9. Attribute Claims: Name: UPN, Name format: unspecified, Value: {{UserName}}, Name space: http://schemas.xmlsoap.org/claims
   10. Attribute Claims:

Name: authnmethodsreferences, Name format: unspecified,

 

Value (custom string): http://schemas.microsoft.com/claims/multipleauthn

Namespace: http://schemas.microsoft.com/claims

http://schemas.microsoft.com/claims

 

11. Click on “Save Changes”.
    
    

 

3. Note down the following fields from the recently created WS-FED Connection. This will be required in the next step.
   1. IdP Id (Beyond Identity Connection ID)
   2. IdP Passive Logon URL: https://auth.byndid.com/wsfed/v1/<BI-Connection-ID>/sso
   3. IdP Issuer: https://auth.byndid.com/wsfed/v1/<BI-Connection-ID>
   4. IdP Metadata URL: https://auth.byndid.com/wsfed/v1/<BI-Connection-ID>/sso/metadata.xml
   5. Download IdP Signature Certificate.

 

Section 8: Configure Beyond Identity as the Identity Provider (WS-FED Federation)

Use the commands below to configure Beyond Identity as the Identity Provider. Alternatively, refer to the Appendix to run a batch script provided by the Beyond Identity field team.

1. Login to any Windows machine and start a power shell as an administrator.
2. Issue following PowerShell commands.

1. Connect-MsolService (Login as Azure AD Global Administrator, you may be required to Install MSOnline PowerShell module using “install-module MSOnline” command)
2. $domain=”contoso.org” (Replace with customer’s alternative domain configured in Section 2)
3. $BrandName = "Beyond Identity WS-FED"
4. $Issuer = “https://auth.byndid.com/wsfed/v1/<BI-Connection-ID>”
5. $LogOnUrl = “https://auth.byndid.com/wsfed/v1/<BI-Connection-ID/sso”
6. $mex = “”
7. $LogOffUrl = “https://portal.azure.com” (or Company website)
8. $SigningCert = "[BI WSFED X.509 certificate in string format]”

(Please make sure the customer downloads the certificate from BI Admin Console or SE should share the certificate by email. Do not send BI certificate via zoom/slack chat).

9. $Protocol = "WSFED"
10. Set-MsolDomainAuthentication -DomainName $domain -Authentication “managed”
11. Set-MsolDomainAuthentication -DomainName $domain -Authentication federated -FederationBrandName $BrandName -IssuerUri $Issuer -PassiveLogOnUri  $LogOnUrl -MetadataExchangeUri $mex -LogOffUri $LogOffUrl  -PreferredAuthenticationProtocol $Protocol -SigningCertificate $SigningCert -SupportsMfa $True

 

Setting up test users

 

User Enrollment

1. To enroll a user in the Beyond Identity experience, assign the user to the “BI_Users” Group in Active Directory.
   1. Right Click on “BI_Users” group and click on “Members” tab.
   2. Click on Add.
   3. In the “Enter the Object names to select”, enter UPN for the user.
   4. Click OK.

 

2. Enrolled user will receive an email from Beyond Identity welcoming them to the new Identity Provider. See image below for reference:
   
   

 

3. Each enrolled user will be asked to follow the two steps below:
   1. Step 1: Download the Beyond Identity Authenticator to their device.
      1. When the user clicks “View Download Options”, the Beyond Identity Authenticator downloads page will open in a browser with all supported platforms displayed. The user should download and install the Beyond Identity Authenticator on their device if they have not already.
      2. Now that the user has the Authenticator installed on their device, they should proceed to Step 2 as there is not yet a user credential associated with the Authenticator on that device.
   2. Step 2: Register their Credential in the Beyond Identity IdP.
      1. By clicking on Step 2 “Register New Credential”, the user’s credential will get enrolled in the Beyond Identity service on the back end. On the front end, users who click Step 2 will be taken to the Beyond Identity Authenticator where they will see the progress of their credential registration. Once completed, the user will see a credentials in the Authenticator. 
      2. See example image below:
         
         

 

 

 

User Authentication (Signing in)

1. Each enrolled user can visit their myapps.microsoft.com (or myapps.company.com or portal.azure.com) site or any application supported by Azure AD SSO to sign into their corporate applications. 
2. The Microsoft applications or SSO-supported application will ask the user to enter their username. (Remember to use Alternate Username during PoC for the passwordless experience)
3. Once the username is submitted, a prompt to use or open the Beyond Identity app for authentication will display for the user.
4. The user should click affirmatively on the prompt to be signed into their application, without the use of a password. The Beyond Identity app along with a success notification will display.
   1. Note: For iOS devices, some application sign-in processes will ask the user to exit out of the Beyond Identity Authenticator to return to their app after successful authentication.

User Deprovisioning

1. To deprovision a user from the Beyond Identity experience, remove user from the “BI_Users” Group in Active Directory.
   1. Right Click on “BI_Users” group and click on “Members” tab.
   2. Select User and click on Remove.
   3. In the confirmation dialog click “Yes”.
   4. Click OK.

Appendices

 

Appendix A: PowerShell Command example to set up Domain for Federated Mode or Managed Mode (WS-FED Specific)

 

PowerShell Commands to setup Azure AD as SSO and Beyond Identity as IdP

1. Connect to Azure AD as Global Administrator

Connect-MsolService

2. Set domain name you want to set up for authentication 

$domain=”contoso.org”

3. Identity IdP Name

$BrandName = "Beyond Identity WS-FED"

4. Logon URL (mandatory)

$LogOnUrl = "https://auth.byndid.com/wsfed/v1/<connection-identifier>/sso"

5. Logoff URL (mandatory)

$LogOffUrl = “https://portal.azure.com” (or Company website)

6. The Beyond Identity WSFED IdP X509 Certificate.

$SigningCert = "[BI WSFED X509 certificate in string format]”

7. Beyond Identity issuer URI 

$issueruri = “https://auth.byndid.com/wsfed/v1/<connection-identitfier>” 

8. Beyond Identity Metadata URI 

$mex = “” 

9. Authentication Protocol

$Protocol = “WSFED”

10. Set up domain for “Federated” Authentication (first set to “managed”)

Set-MsolDomainAuthentication -DomainName $domain -Authentication “managed”

 

Set-MsolDomainAuthentication -DomainName $domain -FederationBrandName $BrandName -Authentication federated -IssuerUri $issueruri -PassiveLogOnUri  $LogOnUrl -MetadataExchangeUri $mex -SigningCertificate $SigningCert -LogOffUri $LogOffUrl  -PreferredAuthenticationProtocol $Protocol -SupportsMfa $True

 

11. To get Domain federation setting

Get-MsolDomainFederationSettings -domainname $domain | fl *

12. To revert domain back to Managed Mode

Set-MsolDomainAuthentication -DomainName $domain -Authentication “managed”

 

Appendix B: PowerShell Command to help debug

 

1. Install MSOnline Powershell Module

Install-Module MSOnline

 

2. Check device is Hybrid joined

dsregcmd /status

 

3. To support Azure AD Created Users, use the following PowerShell Commands:
   1. Connect-MsolService
   2. $upn = “user@contoso.com”
   3. $user = Get-MsolUser -UserPrincipalName $upn
   4. $uuid = [system.convert]::ToBase64String(([GUID]$user.objectID.Guid).ToByteArray())
   5. Set-Msoluser -UserPrincipalName $upn -ImmutableID $uuid

 

4. To support Azure AD Created Users in bulk, use the following PowerShell Command:

This command will be updated soon.

 

5. Check domain is in Managed or Federated mode
   Get-AzureADDomain 

(You need to issue Connect-AzureAD Command first to login to AzureAD as a Global Administrator, before issuing this command)

 

6. Perform delta sync from AD Connect

• Run PowerShell as an Administrator
• If ADSync PowerShell Module is not available install this module by using command “Install-Module ADSync”

Start-ADSyncSyncCycle -PolicyType Delta 

 

7. Command to convert Immutable ID to base64 hash

$immutableId="ZY721Mo4Q0+vLVO9I/1MsQ=="

Write-Host "Convert $immutableId to guid" -NoNewline ([GUID][System.Convert]::FromBase64String($immutableId)).Guid

 

8. Command to convert base64 hash to Immutable ID GUID

$objectid="e35a9b14-12fc-4f9d-9002-05e53ea2bda5"

[Convert]::ToBase64String([guid]::New($objectid).ToByteArray())

 

 

Appendix C: PowerShell Script to automate Commands

 

1. Login to any Windows machine and start a power shell as an administrator.
2. Install MSOnline Powershell 

Install-Module MSOnline

3. Set execution policy to allow the script to be run

Set-ExecutionPolicy Unrestricted

4. Run the below Powershell script in interactive mode

Setup_Beyond_Identity_Auth.ps1

To run in interactive mode:

Right-click on the file name.

Click on Edit.

This will open Powershell ISE.

Review all the parameters.

Click the Green button to run the script.

Login as Azure AD Global Administrator when prompted.

Review the output of the final command to ensure that certificate was uploaded successfully.

Check the Azure Portal and make sure that the domain shows as Federated.

 

 

Appendix D: Azure B2B Integration

 

To enable B2B Integration in Azure AD with Beyond Identity, use following steps.

1. Configure Beyond Identity to receive inbound SAML request from Partner’s Azure AD.
2. Set up Beyond Identity as the external identity Provider in Partner’s Azure AD tenant.
3. Invite External Users to Collaborate.
4. Access partner Apps.

Beyond Identity SAML Connection Configuration for B2B Connections:

1. Once logged into Beyond Identity Admin Console UI, click on the “Integrations” tab and then click on “SAML Connections”.
2. Click on “Add SAML Connection” and update the fields as follows:
   1. Name: Beyond Identity IdP
   2. SP Single on URL: https://login.microsoftonline.com/login.srf 
   3. SP Audience URI: urn:federation: MicrosoftOnline
   4. Name ID Format: Persistent
   5. Subject User Attribute: ExternalID
   6. Request Binding: http-redirect
   7. Signed Response: Signed
   8. X509 (Request) Signing Certificate: Not required
   9. Optional Attributes: Name: IDPEmail, Nameformat: uri, Value: {{UserName}}
   10. Optional Attributes:

Name: http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod

Nameformat: unspecified

Value (custom string): http://schemas.microsoft.com/claims/multipleauthn

11. Click on Save Changes.
    
    

 

3. Note down the following fields from the recently created SAML Connection. This will be required in the next step.
   1. IdP Id (Beyond Identity Connection ID)
   2. IdP Single Sign-On URL: https://auth.byndid.com/saml/v0/<BI-Connection-ID>/sso
   3. IdP Issuer: https://auth.byndid.com/saml/v0/<BI-Connection-ID>/sso/metadata.xml
   4. Download IdP Signature Certificate
   5. Download Metadata file.

 

External Identity Provider Configuration:

1. Log in to Azure Portal as “Global Administrator”.
2. Click on “Azure Active Directory” logo or search “Azure Active Directory” from the “Home” screen.
3. Click on “External Identities” from the left menu bar.
4. Click on “All Identity Providers” from the left menu bar.
5. Click on “New SAML/WS-Fed IdP” from the top menu bar.
6. Select following Parameters for the new external IdP.
   1. Identity Provider Protocol: SAML
   2. Domain name of federating IdP: <fabrikam.com> (Enter your partner’s domain name.)
   3. Select a method for populating metadata: Parse Metadata file (Pull down menu)
   4. Upload metadata file and click on Parse.
   5. Click on “Save”.
      
      

 

 

Create and Invite External Users to Collaborate:

1. Log in to Azure Portal as “Global Administrator”.
2. Click on “Azure Active Directory” logo or search “Azure Active Directory” from the “Home” screen.
3. Click on “Users” from the left side menu.
4. Click on “New guest user” from the top menu.
5. Update following fields before sending invite.
   1. Name: <John Doe>
   2. Email address: john.doe@fabrikam.com
   3. First Name: <John>
   4. Last name: <Doe>
   5. Personal Message: “Message to invite them to collaborate”.
   6. Groups: Add the user to appropriate groups.
   7. Usage Location: <United States>
   8. Click on “Invite”.
6. After accepting invite, user should be able to access applications by going to one of the following URLs.
   1. https://myapps.microsoft.com/?tenantid=<Azure-AD-Tenant-ID>
   2. https://myapps.microsoft.com/<your verified domain>.onmicrosoft.com
   3. https://portal.azure.com/<Azure-AD-Tenant-ID>

 

Appendix E: Azure Staged Rollout

 

To enable Beyond Identity passwordless login to only a subset of users without using an “alternative domain”, use the following steps.

Caveats

1. This configuration is only applicable to Hybrid Azure AD deployments.

2. If you have a Hybrid Azure AD environment, but some users are Azure AD only, then

• Those users will have to use Beyond Identity federation.
• New Azure AD users will have to be created using a special powershell script.
• If those users domain join, they should be set up with WDL or WHfB.
• Domain join has its own unique pre-requisites/nuances (TAP, InTune, etc.)

3. It is recommended that this configuration be used only during the final production deployment and not during the POC stage. 

4. It is recommended that this configuration be carried out during a maintenance window and the users be notified that they may encounter authentication errors during that period.

5. Please refer to this URL for additional information on supported and unsupported scenarios: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-staged-rollout

Pre-requisites

Customer has already moved to one of the following authentication options:

• Password hash synchronization (sync)
• Pass-through authentication
• Azure AD Certificate-based authentication (CBA) settings

Create a New Group

We need to create a new group that will include users that need to be excluded from Beyond Identity. In the beginning, this group should contain ALL the users from this Azure tenant. Then gradually, users can be removed from this group, so they can be authenticated using Beyond Identity. The following steps describe how to create a “Password_Authenticated_Users” Group and assign users to that group.

1. Log in to the Azure Portal (portal.azure.com) as “Global Administrator”.
2. Click on “Azure Active Directory” logo or search “Azure Active Directory” from the “Home” screen.
3. Click on “Groups” from the left menu bar.
4. Click on “New group” from top menu bar with following parameters:
   1. Group Type: Security
   2. Group Name: Password_Authenticated_Users
   3. Group Description: Password Authenticated Users
   4. Membership type: Assigned
   5. Click on the “Create” button to create this group.
5. Right Click on the “Password_Authenticated_Users” group and click on “Members”.
   1. Click on “Add Members” from the top menu.
   2. Select ALL users one by one.
   3. Click on “Select” to add selected users.

Notes:

For tenants with many users, use a script instead to export all users and add them to this group.

 

If you have more than 200 users, the next step (Enable Staged Rollout) will error. As a workaround, don’t add any members to this group (leave it with 0 members), complete the next step first and then run the script to add all users to this group.

Enable Staged Rollout

1. Log in to Azure Portal as “Global Administrator”.
2. Click on “Azure Active Directory” logo or search “Azure Active Directory” from the “Home” screen.
3. Click on “Azure AD Connect” from the left menu bar.
4. Click on “Enable staged rollout for managed user sign-in”.
   
   
   
   
5. Turn on “Password Hash Sync” and click on “Manage groups”.
6. Click on “Add Groups”
7. Select “Password_Authenticated_Users”
8. Click “Select”
   
   

 

Federate the Primary Domain

Configure Beyond Identity as the federated identity provider (federate the primary domain) by referring to the steps in the main section of this guide.

Test Federation to Beyond Identity

Remove a few users from the “Password_Authenticated_Users” group. These users will get federated to Beyond Identity and will login with Beyond Identity without passwords.

Remaining users will continue to login using passwords.

Notes

Post deployment, remember to add every new user to the “Password_Authenticated_Users” group, unless you specifically want to start them with passwordless authentication.

The user NOT in the group becomes eligible for BI Rollout!

When you move the user in and out of this group, it may take some time before the new authentication mechanism becomes effective. This is due to Azure caching issues.