In this video we'll show you how to Enable automatic
user provisioning for Sales force.com.
Enabling automatic user provisioning for an app
consists of these five common steps in the azure management portal.
Step 1 select your application from the gallery of supported apps
or from your list of existing enterprise apps
if it is already enabled for single sign-on.
Step 2 configure user and group assignments
which define who should be provisioned
and have access to the applications.
Step 3 Give the user provisioning service credentials needed
to connect to your applications
user management API.
Step 4 Configure attribute mappings
which define how existing users should be matched
between Azure AD in the app
In what user attributes should be synchronized between the two
and Step 5 Turn on the provisioning service.
In this demo we'll show how to perform these steps
using Sales force.com as the application.
Here I am signed into the
Azure management portal as a global administrator
I'm in the Azure Active Directory section
in the enterprise applications blade
if I were adding Sale force for the first time
I will use the gallery experience
which can be accessed through this button here.
I would find Sales force in the list of supported applications
and I would added.
Since I've already added Sales force
in my Azure Active Directory tenant
I will simply find it in my list of existing applications.
The first step is to assign the users
and/or groups that I would like provisioned to Sales force
I do this by going to the users and groups tab
here I can see a list of users and groups
that are presently assigned for both single sign-on and provisioning
and I will add a new user
by clicking the add user button.
I'll use this control to find and select a user
that I want to bring in scope for provisioning
and click select. The next step will be
to assign the Salesforce role that I want
to the user to be provisioned as,
here I'm going to select chatter free user
and then I click assign and this user has now been
assigned to Salesforce for both single
sign-on and automatic user provisioning.
To configure provisioning I'll click on the provisioning tab
the first step is to provide the Azure AD provisioning service
with Salesforce administrative
credentials that it needs to connect
the Salesforce user management API
I'll provide my Salesforce administrative
username password secret token
as well as the URL to my Salesforce tenant in this form.
To get the secret token
I will go to the Salesforce portal and retrieve it,
from the my personal information area.
If there are any questions
about how to retrieve any of the information required
in the administrative credentials
section you can learn about this
in the documentation for the Salesforce provisioning connector.
which to be found on this website under the app integrations tutorial section
once I've entered my credentials I'll click test connection
and it worked I can optionally enter a notification email,
I can automatically receive updates
if there are any problems with these credentials
and the provisioning service ability to connect to the provisioning API
My next step will be to configure attribute mappings
which will define how user data flows
from Azure Active Directory to salesforce.com.
I'll do this by clicking on
Synchronize Azure AD users to Salesforce here.
I'll scroll down to set my Attribute Mappings
here I can decide which attributes flow from Azure Active Directory
into which Salesforce attributes in the column on the right
the most important mapping
is the mapping between the user principal name and Azure AD
to the user name in salesforce if a user is assigned in Azure AD
and their user principal name does not exist as a salesforce user name
a new account will be created for that user
if the user principal name matches an existing Salesforce user name
then the provisioning service takes over management of that account
and can make updates to it.
To save my attribute mappings I'll click the Save button
and then finally to turn on the provisioning service
I'll set provisioning status to on and click save
once provisioning is turned on the service performs an initial
synchronization, which Retrieves the list of users from Azure AD
filters the users based on assignments and scoping filters
and then synchronizes users to the target application.
Once this initial synchronization is complete
the provisioning service then goes into incremental sync mode
where it only makes changes to the target app
based on changes to the assigned users detected in Azure AD.
This can include detecting and provisioning a newly assigned user
updating user attributes such as names, roles
and contact information
when the corresponding attribute changes in Azure AD
or disabling access when the user is unassigned from the app and Azure AD.
For more detailed information
on all operations performed by the provisioning service
please refer to the URL shown on the screen.
To monitor and troubleshoot user provisioning
see the summary report in the provisioning tab of the azure portal.
This shows the state
of the user provisioning for a selected app and provides a link to the audit logs
which capture and record all actions performed by the provisioning service.
In this next demo we'll show how to use the audit logs,
confirm that a user was successfully provisioned.
Back on the provisioning tab I can see the summary status report
underneath the synchronisation details section
it shows me that I have successfully synchronized three users
and when the synchronization was last run
to view the audit logs I will click the link below .
To verify that a user was successfully provisioned
I will type the user principal name of the user or the first part of it
and this gives me a list of all provisioning actions
executed against this particular user
here I can see that this user abassani
was retrieved from Azure AD and then it was retrieved
successfully from salesforce
and then an update operation was performed by the provisioning service.
I can click on the details to see which attributes were updated
here it shows me that the employee number was detected as modified
in Azure AD and we changed the employee number to this number
in salesforce.com.
In the next video we'll provide tips for rolling out automatic user
provisioning to an application.