Automating User/Group Assignment in Azure for SSO Applications

Question

An application in Microsoft Entra is used for federated single sign-on (SSO) with SAML-based authentication. The goal is to automate the assignment of users and groups to this application using a service account, while facing the following challenges:

According to organizational policy, the automation account cannot be granted roles such as Cloud Application Administrator, Application Administrator, or User Administrator. While it is possible to make the account the owner of the application, bypassing MFA during automatic login is not feasible.

Has anyone successfully implemented automation for user/group assignment under these constraints?

Answer 1

Hi @DiptiRanjan Swain

To automate user or group assignments in Azure for Single Sign-On (SSO) applications, follow these steps:

1.Create a Dynamic Group in Azure:

Navigate to Microsoft Entra ID > Groups > New group.

Set the group type to Security and membership type to Dynamic User.

Define a membership rule based on user attributes. user.department -eq ABC

2.Assign the Dynamic Group to Your Application:

Go to Enterprise Applications > Your Application > Users and groups.

Click add user/group, select the dynamic group, and assign it to the application.

3.Ensure that users who should have access to the application have their department attribute set to "ABC" With this setup, any user whose department attribute is set to "ABC" will automatically be added to the dynamic group.

Since this group is assigned to the application, these users will gain access without manual intervention.

Hope this helps. Do let us know if you any further queries.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 2

HI DiptiRanjan,

I'd like to understand your need to auto-assign admin accounts to your app.

Typically admin accounts are limited and only enabled when needed like with PIM.

The application can be assigned a managed identity, to which admin roles can be applied.

The onboarding of users to your app should not involve admin level privileges.

However it's possible I don't understand your specific requirements for adding admins to your app.

Here are some references which may help:

Microsoft Graph API Documentation

Microsoft Graph API for Application Management: https://learn.microsoft.com/en-us/graph/api/resources/application?view=graph-rest-1.0

App Role Assignments with Graph API: https://learn.microsoft.com/en-us/graph/api/serviceprincipal-post-approleassignments?view=graph-rest-1.0

Microsoft Entra ID Automation

Custom Roles in Microsoft Entra ID: https://learn.microsoft.com/en-us/azure/active-directory/roles/custom-overview

Permissions and Consent Framework: https://learn.microsoft.com/en-us/azure/active-directory/develop/permissions-consent-overview

Enterprise Application Management

Managing Enterprise Applications: https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/what-is-application-management

Automated User Provisioning: https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/user-provisioning

Security Best Practices

Security Best Practices for Application Management: https://learn.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices

Best regards.

Answer 3

Hi @Navya, I turned off "Assignment Required" option on the application in Azure. Now I don't need to add any user/group to it. Just mapping their object id to the 3rd party application's role, allows them to login only with their role.