Introduction

This guide provides information on how to:

• Set up Beyond Identity as a passwordless authentication solution for your Azure AD Only Environment.
• Set up Azure AD to use Beyond Identity as an Identity Provider.
• Set up Beyond Identity Admin Console and User Console applications in Azure AD.
• Set up SCIM based provisioning from Azure AD to Beyond Identity Cloud.

 

Prerequisites

Ensure that you have the following:

1. An Admin Account with “Global Administrator” privileges to:
   1. Configure “Beyond Identity Admin Console” and “Beyond Identity User Console” Applications
   2. Set up SCIM based provisioning from Azure AD to Beyond Identity Cloud
2. An alternative domain name to be used during the Beyond Identity test phase. The alternative domain name must be a top-level domain and not a subdomain. (e.g., for contoso.com as a primary domain, use contoso.org as an alternative domain) You will need access to your alternative domain’s DNS settings to verify the domain in Azure AD.
3. A Windows machine with “Administrator” privileges and powershell modules (MSOnline and AzureAD) to:
   1. Set up the Domain for federated authentication.
   2. Set up the immutableId for AzureAD users created before the Primary domain is federated.
   3. Create users in AzureAD after the Primary domain is federated. (Note: After the Primary domain is federated, users in that domain can only be created via Powershell.)
4. An Office365 “Administrator” account to:
   1. Setup Office365 mailbox accounts.

 

Share the below pre-requisite only if the devices also domain join to Azure AD.

5. An InTune license is required after the Primary domain is federated, if you do “Azure AD only domain join”. InTune Web Sign-in profile enables modern authentication for the desktop which is required to domain join until BI WDL is configured.

Beyond Identity Configuration

Information to provide to the Beyond Identity Field Team:

 

Information you will receive from the Beyond Identity Field Team

 

 

Alternative Domain Configuration

Beyond Identity recommends that you use an alternative domain during the test phase.

First choose a domain to be used. If you already have a spare domain, use that. Otherwise, go to any Domain Registrar and purchase a new domain.

Follow the steps explained here to add this domain as a Custom Domain in the Azure Portal.

https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add-custom-domain

Azure Active Directory Configuration

To configure Beyond Identity as the Federated IdP in Azure Active Directory, follow the steps below. Once these steps are taken, you will be ready to enable Beyond Identity for test users.

Section 1: Set up Azure Active Directory Users 

Create users in Azure Portal using the following steps.(Note: After the Primary domain is federated, users in that domain can only be created via Powershell (Refer to Appendix B5) or via Office365 Admin Center.

1. Log in to the Azure Portal (portal.azure.com) as “Global Administrator”.
2. Click on “Azure Active Directory” logo or search “Azure Active Directory” from the “Home” screen.
3. Click on “Users” from the left menu bar.
4. Click on “New user”.
5. Click on “Create user”.
6. Create a new user by entering the following details:
   1. User name (remember to select the primary domain name from the drop down)
   2. Name
   3. First Name
   4. Last Name
   5. Password (Auto-generate or create one)
   6. Click Create
7.  After the user is created, click the user again, and then click on Edit
   1. Enter Email
8. Now use the following PowerShell Commands:
   1. Install-Module MSOnline (Install MSOnline Powershell Module, if it is not already installed)
   2. Connect-MsolService
   3. $upn = “user@contoso.com”
   4. $user = Get-MsolUser -UserPrincipalName $upn
   5. $uuid = [system.convert]::ToBase64String(([GUID]$user.objectID.Guid).ToByteArray())
   6. Set-Msoluser -UserPrincipalName $upn -ImmutableID $uuid

 

Section 2: Set up Azure Active Directory Groups (Optional: If a customer is using Free Azure Account, then they may not be able to create groups in AAD. In that case, assignment to enterprise application can be done on a per user basis rather than group basis)

Beyond Identity service assignment is required for IT Admin and End Users. The following steps describe how to create BI_Admins, BI_Users and BI_Push_Groups Group and assign users to those groups.

1. Log in to the Azure Portal (portal.azure.com) as “Global Administrator”.
2. Click on “Azure Active Directory” logo or search “Azure Active Directory” from the “Home” screen.
3. Click on “Groups” from the left menu bar.
4. Click on “New group” from top menu bar with following parameters:
   1. Group Type: Security
   2. Group Name: BI_Admins
   3. Group Description: Beyond Identity Admins
   4. Membership type: Assigned
   5. Click on “Create” button to create this group.
5. Right Click on “BI_Admins” group and click on “Members”.
   1. Click on “Add Members” from the top menu.
   2. Search members to be added using UPN and click on their names to select that user.
   3. Click on “Select” to add selected users.
6. From the “Azure Active Directory” home page, click on “Groups” in left menu bar and click on Click on “New group” from top menu bar with following parameters:
   1. Group Type: Security
   2. Group Name: BI_Users
   3. Group Description: Beyond Identity Users
   4. Membership type: Assigned
   5. Click on the “Create” button to create this group.
7. Right Click on the “BI_Users” group and click on “Members”.
   1. Click on “Add Members” from the top menu.
   2. Search members to be added using UPN and click on their names to select the user.
   3. Click on “Select” to add selected users.
8. From the “Azure Active Directory” home page, click on “Groups” in left menu bar and click on Click on “New group” from top menu bar with following parameters:
   1. Group Type: Security
   2. Group Name: BI_Push_Groups
   3. Group Description: Groups used for policy in Beyond Identity
   4. Membership type: Assigned
   5. Click on the “Create” button to create this group.
9. Right Click on the “BI_Push_Groups” group and click on “Members”.
   1. Click on “Add Members” from the top menu.
   2. Search members to be added using group name and click on their names to select the group to be pushed to Beyond Identity.
   3. Click on “Select” to add selected groups.

Section 3: Setup Beyond Identity Admin Console in Azure AD

1. Log in to Azure Portal as “Global Administrator”.
2. Click on “Azure Active Directory” logo or search “Azure Active Directory” from the “Home” screen.
3. Click on “Enterprise Applications” from the left menu bar.
4. Click on “New Application” from the top menu bar.
5. Search for “Beyond Identity” from the top menu bar and select “Beyond Identity Admin Console” App from the App Gallery. Click on “Create” to instantiate this app.

 

6. From the Home -> Tenant Name -> Enterprise Applications -> “Beyond Identity Admin Console” application page.
   1. Click on “Owners” from the left side menu and then click on “Add” from the top menu. Search for users using UPN and click them to select the users. Click on “Select” button to make selected users as the Owner.
   2. Click on “Users and groups” from the left side menu and then click on “Add user/group” and then select “BI_Admins” group. Click on “Assign”. If the AAD license does not allow group creation then assign users to this application individually.
7. From the Home -> Tenant Name -> Enterprise Applications -> “Beyond Identity Admin Console” application page.
   1. Follow steps 1-4, in “Section 4: Setup Admin Portal Access Authentication using SSO” and record SAML Connection ID from Beyond Identity Admin Console and return to perform following steps.
   2. Click on “Single Sign-on” from the left side menu and then click on “SAML” as a single sign-on method.
   3. On the “Set up Single Sign-on with SAML” page click “Edit” on “Basic SAML Configuration” and make following changes (using the values provided by the Beyond Identity SE).
      1. Identifier (Entity ID) https://admin.byndid.com/auth/saml/<connection-id>/sso/metadata.xml 
      2. Reply URL (ACS URL): https://admin.byndid.com/auth/saml/<connection-id>/sso
      3. Mark newly added “Entity ID” and “Reply URL” as default.
      4. Delete “Sample Entity ID”.
      5. Click on the “Save” button.
      6. Close the configuration dialog box by clicking X.
   4. On the “Set up Single Sign-on with SAML” page in the “SAML Signing Certificate” section, click on “Download” for “Certificate (Base64)”.

If the Certificate is not available for download, click on “Edit”, “New Certificate, “Save”, then click on “Download” for “Certificate (Base64)”.

5. Record following URLs from the “Set up Single Sign-on with SAML” page in “Set up Beyond Identity Admin Console” section. You will need this in the next section.
   1. Login URL
   2. Azure AD Identifier

 

Section 4: Setup Admin Portal Access Authentication using SSO

1. Login to Beyond Identity Admin Console by visiting https://admin.byndid.com and click on “Log in with Beyond Identity”.
2. Once logged into Admin Console click on Settings.
3. On the Settings page, click on the Console Login tab.
4. In the “Admin Console SSO Integrations” section click on “Edit SSO” for the Custom SAML SSO section  and configure the following parameters.

1. Record the ID field and use it in the previous section as Connection-ID. 

5. In the “Admin Console SSO Integrations” section click on “Edit SSO” for the Custom SAML SSO section  and configure the following parameters.
   1. Name: Admin Console SSO - Azure
   2. IDP Url: https://login.microsoftonline.com/<azure-tenant-id>/saml2 (Use the value recorded in the previous step)
   3. IDP Entity ID: https://sts.windows.net/<azure-tenant-id>/ (Use the value recorded in the previous step)
   4. Name ID Format: emailAddress 
   5. Subject User Attribute: UserName
   6. Request Binding: http redirect
   7. X509 Signing Certificate: Upload certificate file downloaded in the previous step.
6. After these values are provisioned, login to Beyond Identity Admin Console using SSO and confirm that the admin (user from the BI_Admins group) has access to the Beyond Identity Admin Console.

 

Section 5: Setup Beyond Identity User Console in Azure AD

1. Log in to the Azure Portal as “Global Administrator”.
2. Click on “Azure Active Directory” logo or search “Azure Active Directory” from the “Home” screen.
3. Click on “Enterprise Applications” from the left menu bar.
4. Click on “New Application” from the top menu bar.
5. Click on “Create your own application” from the top menu bar.
6. Enter following parameters on “Create your own application” page:
   1. Name: “Beyond Identity User Console”
   2. For “What are you looking to do with your application?”, select “Integrate any other application you don't find in the gallery (Non-gallery)”
   3. Click on “Create”.
7. From the Home -> Tenant-Name -> Enterprise Applications -> Beyond Identity User Console -> Properties page upload the Beyond Identity logo. (Optional: This helps in Identifying BI Apps easily).
8. Navigate to the “Beyond Identity User Console” App page under App Registrations and click on “Owners” page.
   1. Click on “Add Owners” and Add “Application/Global Admin” as the owner of this application.
9. From the Home -> Tenant-Name -> Enterprise Applications -> Beyond Identity User Console application page:
   1. Click on “Single Sign-on” from the left side menu and then select “Linked”. In the “Sign-On URL”, add:

https://user.byndid.com/auth-user/?org_id=<BI_Tenant_Name>

10. From the Home -> Tenant-Name -> Enterprise Applications -> Beyond Identity User Console -> Provisioning page:
    1. Provisioning Mode: Select “Automatic”.
    2. On the “Admin Credentials” Tab:
       1. Tenant URL: https://api.byndid.com/scim/v2/
       2. Secret Token: <Beyond Identity SE will provide the Tenant API token>
       3. Click on “Test Connection”. 
       4. After successful SCIM connection test, click on “Save”.
    3. On the “Mappings” Tab
       1. Ensure “Provisioning Azure Active Directory Groups” is enabled.
       2. Ensure “Provisioning Azure Active Directory Users” is enabled.
    4. On the “Settings” Tab
       1. Select “Send an email notification when a failure occurs” and provide a valid email address for IT admin.
       2. Scope: “Sync only assigned users and groups”
       3. Click on “Save”.
       4. Provisioning Status: On
11. From the Home -> Tenant Name -> Enterprise Applications -> Beyond Identity User Console -> Provisioning page:
    1. Click on “Update Credentials”
    2. Set “Provisioning Status”: On
    3. Click on “Save”.
12. From the Home -> Tenant-Name -> Enterprise Applications -> Beyond Identity User Console -> Provisioning page:
    1. Click on “Edit Attribute Mappings”.
    2. Click on “Provision Azure Active Directory Users” link.
    3. Ensure “Target Object Actions” has “Create”, “Update” and “Delete” enabled.
    4. Select “Show Advanced Options” and click on “Edit Attribute list for customappsso” to ensure following settings:
       1. id: Primary key, Required Set
       2. active: Required
       3. displayName: Required
       4. emails (work): Required, Multi-Value
       5. username: Required
       6. name.givenName: Required
       7. name.familyName: Required
       8. externalId: Required
       9. Click on “Save”.
    5. On the “Attribute Mappings” list, keep only the following 7 attributes and delete the rest. Also, if any of the below attributes is missing, add it manually
       1. username
       2. active
       3. displayName
       4. emails (work)
       5. name.givenName
       6. name.familyName
       7. externalId

 

6. On the “Attribute Mappings” list, click on the entry for the externalId (click on the left hand side portion of the entry) and update as following:
   1. Mapping Type: Expression
   2. Expression: Switch(IsPresent([immutableId]),[userPrincipalName], "True", [immutableId])
   3. Leave other fields as default and click on “OK”.
   4. On the “Provisioning” page, click on “Save”.

13. From the Home -> Tenant-Name -> Enterprise Applications -> Beyond Identity User Console application page.
    1. Click on “Users and groups” from the left side menu and then click on “Add user/group” and then select “BI_Users” and “BI_Push_Groups” group. Click on “Assign”.  If the AAD license does not allow group creation then assign users to this application individually.
14. In the top search bar, search for “App registrations”, then click on “All Applications”, then select “Beyond Identity User Console”.
    1. From the “Overview” page, note down “Application (client) ID”. This will be required in later steps.
    2. From the “Overview” page, note down “Directory (tenant) ID”. This will be required in later steps.
    3. From the “Authentication” page under Platform Configuration -> Add a platform and Select “Web” and enter:
       1. Redirect URI: https://user.byndid.com/auth-user/callback
       2. Implicit grant and hybrid flows: Select “ID Tokens”
       3. Support Account Type: “Accounts in this organizational directory only (Single Tenant)”
       4. Under “Advanced Settings” for “Allow public client flows” select “No”.
       5. Click on “Save”.
15. Navigate to the “Beyond Identity User Console” App page under “App Registrations” and

click on “Certificates and Secrets”.

1. Under the “Client Secrets” section click on “New client secret”.
2. On the “Add a client secret” page update “Description” field with “Beyond Identity User Console” and set “Expires” field to “24 Months”.
3. Copy the Client Secret from the “Value” column. This will be required in later steps.

16. No changes required to the “Token Configuration” page.
17. Navigate to the “Beyond Identity user Console” App page under App Registrations and click on “API permissions”.
    1. Click on “Add a Permission”. 
    2. Select “Microsoft Graph APIs”.
    3. Select “Delegated Permissions”.
    4. Select OpendID permissions and then select “email”, “offline_access”, “openid”, and “profile”.
    5. Click on “Add Permissions”.
    6. Click on “Grant admin Consent for <Tenant Name>” and then click on “Yes” to grant consent.
18. No changes required to “Expose an API” page.
19. No changes required to the “App Roles” page.

 

Section 6: Setup Beyond Identity User Console:

1. Once logged into Beyond Identity Admin UI, click on Account Settings.

 

 

2. Click on “User Portal” tab and click on “Edit SSO” for OIDC SSO.
3. Edit SSO fields according to following steps and as explained diagram:
   1. Name: <Name of the SSO> e.g. Azure SSO
   2. Client ID: <Use the value recorded in the previous step>
   3. Client Secret: <Use the value recorded in the previous step>
   4. Issuer: https://sts.windows.net/<Azure-AD-Tenant-ID>/ (Remember to add the trailing slash)
   5. Token Field: upn
   6. Token Field Lookup: user name

 

 

4. After these values are provisioned, login and confirm that the user has access to Beyond Identity User Console. (If this step fails, use “provision on demand” steps to provision the user in Beyond Identity first)

Section 7: Setup Beyond Identity Console for User Authentication (WS-FED federation):

1. Once logged into Beyond Identity Admin Console UI, click on the “Integrations” tab and then click on “WS-FED” tab.
2. Click on “Add WS-FED Connection” and update the fields as following:
   1. Name: Azure WS-FED
   2. SP Single Sign on URL: https://login.microsoftonline.com/login.srf
   3. SP Audience URI: https://login.microsoftonline.com/<Azure-AD-Tenant-ID>/
   4. Name ID Format: Unspecified
   5. Subject User Attribute: ExternalID
   6. Authentication Context Class: X509
   7. Attribute Claims: Name: ImmutableID, Name format: unspecified, Value: {{ExternalID}}, Name space: http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID
   8. Attribute Claims: Name: emailaddress, Name format: unspecified, Value: {{Email}}, Name space: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
   9. Attribute Claims: Name: UPN, Name format: unspecified, Value: {{UserName}}, Name space: http://schemas.xmlsoap.org/claims
   10. Attribute Claims:

Name: authnmethodsreferences, Name format: unspecified,

 

Value (custom string): http://schemas.microsoft.com/claims/multipleauthn

Namespace: http://schemas.microsoft.com/claims

 

11. Click on “Save Changes”.

 

3. Note down the following fields from the recently created WSFED Connection. This will be required in the next step.
   1. IdP Id (Beyond Identity Connection ID)
   2. IdP Passive Logon URL: https://auth.byndid.com/wsfed/v1/<BI-Connection-ID>/sso
   3. IdP Issuer: https://auth.byndid.com/wsfed/v1/<BI-Connection-ID>
   4. IdP Metadata URL: https://auth.byndid.com/wsfed/v1/<BI-Connection-ID>/sso/metadata.xml
   5. Download IdP Signature Certificate.

Section 8: Configure Beyond Identity as the Identity Provider (WS-FED Federation)

Use the commands below to configure Beyond Identity as the Identity Provider. Alternatively, refer to the Appendix to run a batch script provided by the Beyond Identity field team.

1. Login to any Windows machine and start a power shell as an administrator.
2. Issue following PowerShell commands.

1. Connect-MsolService (Login as Azure AD Global Administrator, you may be required to Install MSOnline PowerShell module using “install-module MSOnline” command)
2. $domain=”contoso.org” (Replace with customer’s alternative domain configured in Section 2)
3. $BrandName = "Beyond Identity WS-FED"
4. $Issuer = “https://auth.byndid.com/wsfed/v1/<BI-Connection-ID>”
5. $LogOnUrl = “https://auth.byndid.com/wsfed/v1/<BI-Connection-ID/sso”
6. $mex = “”
7. $LogOffUrl = “https://portal.azure.com” (or Company website)
8. $SigningCert = "[BI WSFED X.509 certificate in string format]”
9. $Protocol = "WSFED"
10. Set-MsolDomainAuthentication -DomainName $domain -Authentication “managed”
11. Set-MsolDomainAuthentication -DomainName $domain -Authentication federated -FederationBrandName $BrandName -IssuerUri $Issuer -PassiveLogOnUri  $LogOnUrl -MetadataExchangeUri $mex -LogOffUri $LogOffUrl  -PreferredAuthenticationProtocol $Protocol -SigningCertificate $SigningCert -SupportsMfa $True

 

Setting up test users

 

User Enrollment

1. To enroll a user in the Beyond Identity experience, assign the user to the “BI_Users” Group in Azure Active Directory. (Optional: This step is required if you are able to create “BI_Users” group in the Azure AD)
   1. Right Click on the “BI_Users” group and click on the “Members” tab.
   2. Click on Add.
   3. Select the user.
   4. Click OK.
2. To enroll a user in the Beyond Identity experience, assign the user to the “BI_Users” Group in Azure Active Directory. (Optional: This step is required if you are NOT able to create the user using the step above.)
   1. From the Home -> Tenant-Name -> Enterprise Applications -> Beyond Identity User Console -> Users and groups  page:
   2. Click on the “Add user/group”.
   3. Click on “None Selected” under Users and Groups.
   4. On the search page, select the user and click on “Select”.
   5. Click Assign.
3. Enrolled users will receive an email from Beyond Identity welcoming them to the new Identity Provider.
   1. See image below for reference:

 

 

4. Each enrolled user will be asked to follow the two steps below:
   1. Step 1: Download the Beyond Identity Authenticator to their device.
      1. When the user clicks “View Download Options”, the Beyond Identity Authenticator downloads page will open in a browser with all supported platforms displayed. The user should download and install the Beyond Identity Authenticator on their device if they have not already.
      2. Now that the user has the Authenticator installed on their device, they should proceed to Step 2 as there is not yet a user credential associated with the Authenticator on that device.
   2. Step 2: Register their Credential in the Beyond Identity IdP.
      1. By clicking on Step 2 “Register New Credential”, the user’s credential will get enrolled in the Beyond Identity service on the back end. On the front end, users who click Step 2 will be taken to the Beyond Identity Authenticator where they will see the progress of their credential registration. Once completed, the user will see the credentials in the Authenticator. 
      2. See example image below:

 

 

User Authentication (Signing in)

1. Each enrolled user can visit their myapps.microsoft.com (or myapps.company.com or portal.azure.com) site or any application supported by Azure AD SSO to sign into their corporate applications. 
2. The Microsoft applications or SSO-supported application will ask the user to enter their username. (Remember to use Alternate Username during PoC for the passwordless experience)
3. Once the username is submitted, a prompt to use or open the Beyond Identity app for authentication will display for the user.
4. The user should click affirmatively on the prompt to be signed into their application, without the use of a password. The Beyond Identity app along with a success notification will display.
   1. Note: For iOS devices, some application sign-in processes will ask the user to exit out of the Beyond Identity Authenticator to return to their app after successful authentication.

User Deprovisioning

1. To deprovision a user from the Beyond Identity experience, remove user from the “BI_Users” Group in Azure Active Directory.
   1. Right Click on the “BI_Users” group and click on the “Members” tab.
   2. Select User and click on Remove.
   3. In the confirmation dialog click “Yes”.
   4. Click OK.

 

Appendices

 

Appendix A: PowerShell Command example to set up Domain for Federated Mode or Managed Mode (WS-FED Specific)

 

PowerShell Commands to setup Azure AD as SSO and Beyond Identity as IdP

1. Connect to Azure AD as Global Administrator

Connect-MsolService

2. Set domain name you want to set up for authentication 

$domain=”contoso.org”

3. Identity IdP Name

$BrandName = "Beyond Identity WS-FED"

4. Logon URL (mandatory)

$LogOnUrl = "https://auth.byndid.com/wsfed/v1/<connection-identifier>/sso"

5. Logoff URL (mandatory)

$LogOffUrl = “https://portal.azure.com” (or Company website)

6. The Beyond Identity WSFED IdP X509 Certificate.

$SigningCert = "[BI WSFED X509 certificate in string format]”

7. Beyond Identity issuer URI 

$issueruri = “https://auth.byndid.com/wsfed/v1/<connection-identitfier>” 

8. Beyond Identity Metadata URI 

$mex = “” 

9. Authentication Protocol

$Protocol = “WSFED”

10. Set up domain for “Federated” Authentication (first set to “managed”)

Set-MsolDomainAuthentication -DomainName $domain -Authentication “managed”

 

Set-MsolDomainAuthentication -DomainName $domain -FederationBrandName $BrandName -Authentication federated -IssuerUri $issueruri -PassiveLogOnUri  $LogOnUrl -MetadataExchangeUri $mex -SigningCertificate $SigningCert -LogOffUri $LogOffUrl  -PreferredAuthenticationProtocol $Protocol -SupportsMfa $True

 

11. To get Domain federation setting

Get-MsolDomainFederationSettings -domainname $domain | fl *

12. To revert domain back to Managed Mode

Set-MsolDomainAuthentication -DomainName $domain -Authentication “managed”

 

Appendix B: PowerShell Command to help debug

 

1. Install MSOnline Powershell Module

Install-Module MSOnline

 

2. Install AzureAD Powershell Module

Install-Module AzureAD

 

3. Check device is Hybrid joined

dsregcmd /status

 

4. To support Azure AD Created Users, use the following PowerShell Commands:
   1. Connect-MsolService
   2. $upn = “user@contoso.com”
   3. $user = Get-MsolUser -UserPrincipalName $upn
   4. $uuid = [system.convert]::ToBase64String(([GUID]$user.objectID.Guid).ToByteArray())
   5. Set-Msoluser -UserPrincipalName $upn -ImmutableID $uuid

 

5. To create Azure AD Users after the Primary domain is federated, use the following PowerShell Commands:
   1. Connect-AzureAD
   2. $domain = “contoso.com”
   3. $First_name = "First"
   4. $Last_name = "Last"
   5. $Display_name = $First_name + " " + $Last_name
   6. $UPN = $First_name + "." + $Last_name + "@" + $domain 
   7. $Mail_nickname = $First_name + "." + $Last_name
   8. $guid = [guid]::NewGuid() 
   9. $immutableid = [system.convert]::ToBase64String(($guid).ToByteArray())
   10. $PasswordProfile = New-Object -TypeName Microsoft.Open.AzureAD.Model.PasswordProfile
   11. $countryCode = "US"
   12. New-AzureADUser -DisplayName $Display_name -PasswordProfile $PasswordProfile -UserPrincipalName $UPN -AccountEnabled $true -ImmutableId $immutableid -GivenName $First_name -SurName $Last_name -mailnickname $Mail_nickname -usageLocation $countryCode
6. To support Azure AD Created Users in bulk, use the following PowerShell Command:

This command will be updated soon.

 

7. Check domain is in Managed or Federated mode
   Get-AzureADDomain 

(You need to issue Connect-AzureAD Command first to login to AzureAD as a Global Administrator, before issuing this command)

 

8. Command to convert Immutable ID to base64 hash

$immutableId="ZY721Mo4Q0+vLVO9I/1MsQ=="

Write-Host "Convert $immutableId to guid" -NoNewline ([GUID][System.Convert]::FromBase64String($immutableId)).Guid

 

9. Command to convert base64 hash to Immutable ID GUID

$objectid="e35a9b14-12fc-4f9d-9002-05e53ea2bda5"

[Convert]::ToBase64String([guid]::New($objectid).ToByteArray())

 

 

Appendix C: PowerShell Script to automate Commands

 

1. Login to any Windows machine and start a power shell as an administrator.
2. Install MSOnline Powershell 

Install-Module MSOnline

3. Set execution policy to allow the script to be run

Set-ExecutionPolicy Unrestricted

4. Run the below Powershell script in interactive mode

Setup_Beyond_Identity_Auth.ps1

To run in interactive mode:

Right-click on the file name.

Click on Edit.

This will open Powershell ISE.

Review all the parameters.

Click the Green button to run the script.

Login as Azure AD Global Administrator when prompted.

Review the output of the final command to ensure that certificate was uploaded successfully.

Check the Azure Portal and make sure that the domain shows as Federated.

 

Appendix D: Azure B2B Integration

 

To enable B2B Integration in Azure AD with Beyond Identity, use the following steps.

1. Configure Beyond Identity to receive inbound SAML requests from Partner’s Azure AD.
2. Set up Beyond Identity as the external identity Provider in Partner’s Azure AD tenant.
3. Invite External Users to Collaborate.
4. Access partner Apps.

Beyond Identity SAML Connection Configuration for B2B Connections:

1. Once logged into Beyond Identity Admin Console UI, click on “Integrations” tab and then click on “SAML Connections”.
2. Click on “Add SAML Connection” and update the fields as following:
   1. Name: Beyond Identity IdP
   2. SP Single on URL: https://login.microsoftonline.com/login.srf 
   3. SP Audience URI: urn:federation:MicrosoftOnline
   4. Name ID Format: Persistent
   5. Subject User Attribute: ExternalID
   6. Request Binding: http-redirect
   7. Signed Response: Signed
   8. X509 (Request) Signing Certificate: Not required
   9. Optional Attributes: Name: IDPEmail, Nameformat: uri, Value: {{UserName}}
   10. Optional Attributes:

Name: http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod

Nameformat: unspecified

Value (custom string): http://schemas.microsoft.com/claims/multipleauthn

11. Click on “Save Changes”

 

 

3. Note down the following fields from the recently created SAML Connection. This will be required in the next step.
   1. IdP Id (Beyond Identity Connection ID)
   2. IdP Single Sign-On URL: https://auth.byndid.com/saml/v0/<BI-Connection-ID>/sso
   3. IdP Issuer: https://auth.byndid.com/saml/v0/<BI-Connection-ID>/sso/metadata.xml
   4. Download IdP Signature Certificate
   5. Download Metadata file.

 

External Identity Provider Configuration:

1. Log in to Azure Portal as “Global Administrator”.
2. Click on “Azure Active Directory” logo or search “Azure Active Directory” from the “Home” screen.
3. Click on “External Identities” from the left menu bar.
4. Click on “All Identity Providers” from the left menu bar.
5. Click on “New SAML/WS-Fed IdP” from the top menu bar.
6. Select following Parameters for the new external IdP.
   1. Identity Provider Protocol: SAML
   2. Domain name of federating IdP: <fabrikam.com> (Enter your partner’s domain name.)
   3. Select a method for populating metadata: Parse Metadata file (Pull down menu)
   4. Upload metadata file and click on Parse.
   5. Click on “Save”.

 

 

Create and Invite External Users to Collaborate:

1. Log in to Azure Portal as “Global Administrator”.
2. Click on “Azure Active Directory” logo or search “Azure Active Directory” from the “Home” screen.
3. Click on “Users” from the left side menu.
4. Click on “New guest user” from the top menu.
5. Update following fields before sending an invite.
   1. Name: <John Doe>
   2. Email address: john.doe@fabrikam.com
   3. First Name: <John>
   4. Last name: <Doe>
   5. Personal Message: “Message to invite them to collaborate”.
   6. Groups: Add the user to appropriate groups. (Optional)
   7. Usage Location: <United States>
   8. Click on “Invite”.
6. After accepting an invite, a user should be able to access applications by going to one of the following URLs.
   1. https://myapps.microsoft.com/?tenantid=<Azure-AD-Tenant-ID>
   2. https://myapps.microsoft.com/<your verified domain>.onmicrosoft.com
   3. https://portal.azure.com/<Azure-AD-Tenant-ID>