# Azure Active Directory

You can sync Azure Active Directory with Infraon to enable synchronization of user/requester accounts. Follow the below steps to configure Azure Active Directory. 

## Pre-requisites  <a href="#toc174553351" id="toc174553351"></a>

* An active Azure account&#x20;

## The Process  <a href="#toc174553352" id="toc174553352"></a>

Follow the below steps on your Azure portal.&#x20;

**Step 1:** **Register your app**&#x20;

1\. Log in to your Azure account and click 'App Registrations.'&#x20;

![](/files/teKioLbJWQnVkjyJC9CX)

2\. Select 'New registration.'&#x20;

![](/files/pnWCdbdwi2jCZMWgRLkG)

3\. Add a display name for your application, select the account type, and click 'Register.'&#x20;

![](/files/rsCyatu3szFcrHNXiPZX)

4\. The application is created, and the details are displayed per the reference screenshot. Copy the Application and Tenant ID.&#x20;

![](/files/d5H2TU2evD3mjXWs32ym)

**Step 2: Enable API Permissions**&#x20;

1\. Navigate to ' API Permissions' and click 'Add a permission.'&#x20;

![](/files/bSJJApAFEr8PpGx4CRnW)

2\. A slider appears. Click on the 'APIs my organization uses' tab.&#x20;

![](/files/kuGoF0oblD85STXqy8H1)

3\. Select 'Microsoft Graph' from the list of APIs displayed.&#x20;

![](/files/QwjwyJ8yR2iuosfjEUQD)

4\. Scroll down and look for 'User' related APIs. Expand and select 'User. Read.All' to enable.&#x20;

![](/files/c8h3qOANcaoPq76ZdfOj)

5\. Once the permissions are added, details are displayed per the reference.&#x20;

![](/files/4CZ9YxzP9gJOgtzGBuUG)

6\. Click on 'Grand Admin Consent' and confirm your selection.&#x20;

![](/files/upUACaoKXhMzOYFYdE4A)

![](/files/dTjTujqrl3sLnQqrtC6x)

**Step 3: Create a client secret**&#x20;

1\. Navigate to 'Certificates and secrets' -> Client Secrets.&#x20;

![](/files/CWkMjPvsks11LU6KtWIB)

2\. Add a new client secret. Provide a description and an expiration date. The client secret is valid only for the selected period. A new client must be created on the expiry of this. Click 'Add' once done.&#x20;

![etCache\Content.MSO\84ABFF3F.tmp](/files/B9H0ulgF7SgAMZ1QPMQ2)

3\. The client secret is generated. Copy the value to the clipboard. Please note that this value will be hidden on page refresh.&#x20;

![](/files/fpukMIQnMSxEk2XRn00e)

**Step 4: Register your app on Infraon.**&#x20;

1\. Navigate to Infraon -> Market Place -> Azure Active Directory (Azure AD). Click 'Install'. Add the 'Talent ID, Client ID, and Secret Key. Click 'Verify.'&#x20;

![](/files/xuYbEFuhYBsQVYEsCses)

2\. Per the reference screenshot, you will be redirected to the field mapping screen upon successful verification. In the tabs below on Infraon, select column names to the respective field names.&#x20;

* &#x20;Requester&#x20;
* &#x20;Work&#x20;
* &#x20;Address&#x20;

![](/files/5zeWLfSrHbkpYhkcV5y5)

3\. Click 'Submit' when you are done. Infraon might take a few minutes to complete the synchronization. Once complete, all your Azure users are added as requesters on Infraon.&#x20;

### **How to Install**

**Step 1:** Go to the Marketplace tab from the left navigation panel. Under the available integrations, locate and select the **Azure AD** card to open the integration details page.

![](/files/d67122a6212081551dc2f8bf1a487736c7e4c000)

**Step 2:** On the Azure AD plugin details page, click **Install** to add the integration to your Infraon environment.

After successful installation, the Azure AD configuration page becomes available for further setup and verification.

![](/files/067e8b4830da2efd83cf468a23e171787960bc60)

**Step 3:** Enter the required Azure AD **configuration details** to establish communication between Infraon Infinity and Microsoft Azure Active Directory.

These details are used to authenticate the integration, synchronize requester information, and enable requester login through Azure AD Single Sign-On (SSO).

<table><thead><tr><th width="154.5999755859375">Label</th><th width="211.199951171875">Action</th><th>Description / Example</th></tr></thead><tbody><tr><td><strong>Config Name</strong></td><td>Enter configuration name</td><td>Specify a unique name for the Azure AD integration configuration.<strong>Example:</strong> Infraon - Azure AD Directory</td></tr><tr><td><strong>Tenant ID</strong></td><td>Enter Azure AD Tenant ID</td><td>Specify the Tenant ID generated from the Microsoft Azure portal for the registered application. This is used to identify the Azure AD directory instance.</td></tr><tr><td><strong>Client ID</strong></td><td>Enter Client/Application ID</td><td>Provide the Client ID associated with the registered Azure AD application created for Infraon integration.</td></tr><tr><td><strong>Secret Key</strong></td><td>Enter client secret value</td><td>Specify the Secret Key generated for the Azure AD application. This key is used for secure authentication between Infraon Infinity and Azure AD services.</td></tr><tr><td><strong>SSO Unique Key</strong></td><td>Select a unique requester attribute</td><td>Select the unique attribute used to identify and authenticate synchronized users during SSO login.<strong>Example:</strong> Email</td></tr><tr><td><strong>Sync</strong></td><td>Select synchronization type</td><td>Choose the object type to synchronize from Azure AD into Infraon Infinity. Example: Requester</td></tr><tr><td><strong>Allow Requester Login</strong></td><td>Enable requester SSO login</td><td>Enable this option to allow synchronized requesters to log in to the Infraon Self-Service Portal using Azure AD credentials.</td></tr><tr><td><strong>Verify</strong></td><td>Validate Azure AD configuration</td><td>Verifies the entered Tenant ID, Client ID, and Secret Key by testing the connection with Azure AD before proceeding with synchronization.</td></tr></tbody></table>

![](/files/a5cf2d717fee75681444d293ddd1c73095200b81)

Once the configuration details are added, use **Verify** to validate the Azure AD connection and continue with the integration setup.

**Step 4:** After verifying the Azure AD connection, navigate to the **Login Settings** tab to configure the user attribute used for requester authentication and login mapping.

The Login Settings section allows administrators to define the Azure AD attribute that Infraon Infinity should use as the requester's username during authentication and synchronization.

<table><thead><tr><th width="157.79998779296875">Label</th><th width="166.20001220703125">Action</th><th>Description / Example</th></tr></thead><tbody><tr><td><strong>Username</strong></td><td>Select the Azure AD user attribute</td><td>Select the Azure AD attribute that should be mapped as the requester login username in Infraon Infinity. Commonly used attributes include mail, userPrincipalName, or other Azure AD user properties.<br><br><strong>Example:</strong> mail</td></tr><tr><td><strong>Attribute Search</strong></td><td>Search and select attribute</td><td>Use the dropdown search to browse and select available Azure AD attributes retrieved from the connected directory instance.</td></tr><tr><td><strong>Login Mapping</strong></td><td>Configure requester authentication mapping</td><td>Maps the selected Azure AD attribute with Infraon requester accounts to support SSO authentication and requester identification during login.</td></tr></tbody></table>

![](/files/9eefad08af9095a7eebbf2c11525338f77ec6b1b)

Select **Next** to save the configured Login Settings and proceed to the next step of the Azure AD integration setup.

**Step 5:** After configuring the Login Settings, navigate to the **Requester** tab to map Azure AD user attributes with requester fields available in Infraon Infinity.

This section allows administrators to define how requester information from Azure AD should be synchronized into the Infraon platform. The selected Azure AD attributes are previewed automatically to help validate the mapping configuration before synchronization.

<table><thead><tr><th width="164.20001220703125">Label</th><th width="196.5999755859375">Action</th><th>Description / Example</th></tr></thead><tbody><tr><td><strong>Full Name</strong></td><td>Select Azure AD attribute</td><td>Maps the requester's full name field in Infraon Infinity with the corresponding Azure AD user attribute.</td></tr><tr><td><strong>Email</strong></td><td>Select Azure AD attribute</td><td>Maps the requester email address from Azure AD. This field is commonly mapped using attributes such as mail or userPrincipalName.</td></tr><tr><td><strong>Phone Number</strong></td><td>Select Azure AD attribute</td><td>Maps the requester's mobile or contact number from Azure AD user details.</td></tr><tr><td><strong>Landline</strong></td><td>Select Azure AD attribute</td><td>Maps the requester's landline or office contact number from Azure AD.</td></tr><tr><td><strong>Tags</strong></td><td>Select Azure AD attribute</td><td>Maps Azure AD attributes that can be used as requester tags or classification values within Infraon Infinity.</td></tr><tr><td><strong>Reporting Manager</strong></td><td>Select Azure AD attribute</td><td>Maps the reporting manager or supervisor information from Azure AD user records.</td></tr><tr><td><strong>Azure AD Details</strong></td><td>View available Azure AD attributes</td><td>Displays the list of available Azure AD user attributes retrieved from the connected tenant for field mapping.</td></tr><tr><td><strong>Preview Data</strong></td><td>View synchronized sample data</td><td>Displays preview values from the selected Azure AD user attribute to validate mapping accuracy before synchronization.</td></tr><tr><td><strong>Change User</strong></td><td>Load another Azure AD user preview</td><td>Allows administrators to switch the preview user used to validate field mappings against a different Azure AD account.</td></tr></tbody></table>

![](/files/c0b2c48635ade711e2b98f465d1f4e106faa4122)

The **Work** and **Address** sections follow the same field mapping process as the Requester configuration. Administrators can map Azure AD attributes to the corresponding Infraon Infinity work and location fields and use the preview data section to validate the synchronized values before proceeding.

Once the required mappings are completed, select **Submit** to save the configuration.

The Azure AD integration is now installed.

#### **Settings**

The Settings page allows administrators to manage the Azure AD integration, synchronize user data, update configuration settings, schedule automatic sync jobs, and export unsynchronized records for troubleshooting and validation.

![](/files/7f60e6a8e0ecc35cf4b95d3fa469bc768edb0164)

<table><thead><tr><th width="179.4000244140625">Label</th><th width="145.5999755859375">Action</th><th>Description / Example</th></tr></thead><tbody><tr><td><strong>Sync Data</strong></td><td>Sync Now</td><td>Initiates an immediate synchronization between <strong>Azure AD and Infraon Infinity</strong> to fetch and update the latest requester and user details. The section also displays synchronization statistics, including Total Data Synced, Failed During Data Sync, and Last Synced Time, to monitor synchronization activity.</td></tr><tr><td><strong>AD - Infraon Configuration</strong></td><td>Configuration</td><td>Opens the Azure AD integration configuration settings page to modify or update mapped fields, authentication details, requester synchronization settings, login settings, and other Azure AD integration configurations.</td></tr><tr><td><strong>Schedule Sync</strong></td><td>Schedule</td><td>Configures automatic synchronization schedules between Azure AD and Infraon Infinity.</td></tr><tr><td><strong>Export Unsync Data</strong></td><td>Export</td><td>Downloads a CSV file containing records that were not synchronized successfully from Azure AD.</td></tr></tbody></table>

## Requester Login via SSO

Azure AD–synced requesters can log in to the Infraon Self-Service Portal using Microsoft Single Sign-On (SSO). Authentication and access management for requesters occur when a ticket is created under any workflow configured with App Integration.

It includes scenarios such as:

* Successful login via SSO
* Invalid login attempts
* Session management
* Multi-device login
* Error handling
* Audit logging

### **How It Works**

1\.   Navigate to **Infraon Configuration → Infraon Automation →** [**Workflow**.](/infraon-help/infinity-user-guide/infraon-configuration/infraon-automation/workflow.md)

2\.   Select the required **Ticket Workflow** and click **Edit**.

3\.   In the **Configure Workflow** section, expand the **left-side panel** using the double arrow icon.

<figure><img src="/files/EaG82nc2U5Oamng3dPTW" alt=""><figcaption></figcaption></figure>

4\.   Under the **Actions** category, select **App Integration**.

<figure><img src="/files/5jkn2c1LeXPLYjSUldHa" alt=""><figcaption></figcaption></figure>

5\.   Select the Azure AD app (installed from Infraon Marketplace Integration) from the dropdown.

<figure><img src="/files/X0kzBVA5EYmYZtQtaXIZ" alt=""><figcaption></figcaption></figure>

6\.   Once selected, you will see three options to configure Azure AD account actions.

<figure><img src="/files/rqEiANeuuZ8C9YqfW9yz" alt=""><figcaption></figcaption></figure>

**Azure AD Actions | Details**

<table data-header-hidden><thead><tr><th width="211" valign="top"></th><th valign="top"></th><th valign="top"></th></tr></thead><tbody><tr><td valign="top"><strong>Label</strong></td><td valign="top"><strong>Description</strong></td><td valign="top"><strong>Scenario</strong></td></tr><tr><td valign="top"><strong>Force Password Reset on Next Login</strong></td><td valign="top">Triggers a temporary password reset and forces the requester to set a new password during their next login via SSO. An email with the temporary password is sent.</td><td valign="top">Use when the requester’s credentials may be compromised, or after IT security updates, ensuring the user resets their password before continuing access.</td></tr><tr><td valign="top"><strong>Unlock User Account</strong></td><td valign="top">Unlocks a requester’s locked account due to multiple failed login attempts or admin restrictions. No email notification is sent.</td><td valign="top">Use it when a requester is unable to access the portal due to lockout errors. This ensures quick access restoration without requiring manual IT intervention.</td></tr><tr><td valign="top"><strong>Disable (Lock) User Account</strong></td><td valign="top">Disables a requester’s account, preventing login until re-enabled. No email notification is sent.</td><td valign="top">Use when an account needs to be temporarily restricted—e.g., requester leaves the organization, suspicious activity is detected, or compliance rules require suspension.</td></tr></tbody></table>

This ensures IT admins can automate user account management actions within ticket workflows, integrating **Azure AD SSO policies** directly into **Infraon Infinity Automation**.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.infraon.io/infraon-help/infinity-user-guide/marketplace/azure-active-directory.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.