We noticed that JavaScript is disabled in your browser. We suggest enabling it for a better experience.
We noticed you're using an older version of Internet Explorer. We suggest you update to the latest version for a better experience.
Skip to main content
Print

Manage users with Azure AD

If your organization uses Microsoft Azure AD to manage staff access to apps and services, you can use the Azure AD connector to manage staff access to OpenForms, too. 
The Azure AD connector is a premium (paid) connector.

 Go to Integrations > Connectors > Azure AD and select Upgrade to access to discuss adding this connector to your OpenForms plan. 

Benefits of the connector

Use the Azure AD connector to:

  • Speed up onboarding by automatically assigning OpenForms roles to any staff members added to particular Azure AD user groups. They can login immediately with their Microsoft SSO credentials for your organization. 
  • Take advantage of Microsoft's login processes, including two factor authentication and login auditing.
  • As staff move between positions in your organization, simply move them between Azure AD user groups to give them all the permissions they need for their job (and none that they don’t). When they leave, deactivating their Azure AD profile automatically deactivates their OpenForms account. 
  • Optional: Further streamline onboarding and role changes by assigning Azure AD user groups to workspaces.

Before you begin

Before you install the Azure AD connector, it’s important to discuss an implementation plan with your IT team. 

You’ll need your Azure AD administrator’s help to establish a connection to Azure AD, and they’ll need your input to tailor the connection to your organization’s needs.

To prepare:  

  1. Learn how the Azure AD connector works. We've created an article that explains the key terms, concepts and choices involved in setting up the connector in plain language. This will help you work effectively with your Azure AD administrator.
  2. Direct your Azure AD administrator to our Azure AD setup guide.  This article provides a walkthrough of the connection process for Azure AD administrators.
  3. Discuss the choices outlined in how the Azure AD connector works with your Azure AD administrator.

Getting started

When you're ready to install the connector:

  1. Make sure your Azure AD administrator is available, and has our Azure AD setup guide open. 
  2. Go to Integrations > Connectors > Azure AD, and select Connect.
    Connect.png
    This will open the connection wizard.
  3. When you're directed to, pass on the tenant URL and secret token to your Azure AD administrator.
  4. Your Azure AD administrator will complete the connection process. 
  5. When your Azure AD administrator has completed the process, select proceed to role assignment. 
    Proceed.png
    This will take you to the Azure AD configuration screen.
    Azure AD config.png
    Here you can assign OpenForms roles to Azure AD user groups.

Once the Azure AD connector is installed, you can return to the Azure AD configuration screen at any time by going to Integrations > Connectors > Azure AD > Edit Azure AD configuration

Assign roles

For a full guide to assigning OpenForms roles to provisioned Azure AD user groups, see assign OpenForms roles to Azure AD user groups.

User quotas

Because the number of staff members in an Azure AD user group is managed outside of OpenForms, it is possible to exceed your organization's user quota as staff are added to Azure AD user groups that have already been assigned OpenForms roles.

If this happens, all of your organization's users will have their editing and publishing actions disabled until your organization is back within its user limit.

Regenerate tokens

From time to time, your IT team may require you to regenerate the secret token used to establish a connection between OpenForms and Azure AD. This is typically done if your security policy stipulates a token lifespan, similar to a password update policy.  

To do this:

  1. Go to Integrations > Connectors > Azure AD.
  2. Select Edit connection.
    edit connection.png
  3. Confirm that you understand that regenerating your secret token will pause provisioning until your Azure AD administrator enters the new token, then select Regenerate.
    Regenerate.png
    While provisioning is paused, OpenForms won't receive updates from Azure AD, but your existing staff can continue to use their logins and roles as before. 
  4. Pass on your new secret token and, if necessary, your tenant URL, to your Azure AD administrator.
    Your tenant URL isn't normally required as this does not change when you regenerate a token.
  5. Close the edit connection window. 

Your Azure AD administrator will let you know when the new token has been entered and Azure AD has resumed sending user group data to OpenForms. 

Disconnect from Azure AD

Disconnecting from Azure AD will permanently deactivate any OpenForms users currently managed through the Azure AD connector, and remove any roles and workspaces assigned to Azure AD user groups. This step cannot be undone.To permanently disconnect the Azure AD connector:

  1. Discuss your plan with your IT team.
  2. Go to integrations > connectors > Azure AD.
  3. Select Disconnect from the Edit Connection dropdown menu.
    disconnect.png
  4. Type DISCONNECT in the confirmation dialog, and select Disconnect.

Once disconnected, OpenForms will not receive further data from Azure AD unless you establish a new connection.

We recommend you let your Azure AD administrator know when you have completed disconnection so they can remove OpenForms from their application list. 

What’s next?

 

 

Was this helpful?

Related topics