Edit

Tutorial: Azure Active Directory SSO integration with Cloud Academy

  • Article
  • 7 minutes to read

In this tutorial, you learn how to integrate Cloud Academy with Azure Active Directory (Azure AD). When you integrate Cloud Academy with Azure AD, you can:

  • Use Azure AD to control who can access Cloud Academy.
  • Enable your users to be automatically signed in to Cloud Academy with their Azure AD accounts.
  • Manage your accounts in one central location: the Azure portal.

Prerequisites

To get started, you need the following items:

  • An Azure AD subscription. If you don't have a subscription, you can get a free account.
  • A Cloud Academy subscription with single sign-on (SSO) enabled.

Tutorial description

In this tutorial, you configure and test Azure AD SSO in a test environment.

  • Cloud Academy supports SP initiated SSO.
  • Cloud Academy supports Just In Time user provisioning.
  • Cloud Academy supports Automated user provisioning.

To configure the integration of Cloud Academy into Azure AD, you need to add Cloud Academy from the gallery to your list of managed SaaS apps:

  1. Sign in to the Azure portal with a work or school account or with a personal Microsoft account.
  2. In the left pane, select Azure Active Directory.
  3. Go to Enterprise applications and then select All Applications.
  4. To add an application, select New application.
  5. In the Add from the gallery section, enter Cloud Academy in the search box.
  6. Select Cloud Academy in the results panel and then add the app. Wait a few seconds while the app is added to your tenant.

Alternatively, you can also use the Enterprise App Configuration Wizard. In this wizard, you can add an application to your tenant, add users/groups to the app, assign roles, and walk through the SSO configuration as well. Learn more about Microsoft 365 wizards.

Configure and test Azure AD SSO for Cloud Academy

You'll configure and test Azure AD SSO with Cloud Academy by using a test user named B.Simon. For SSO to work, you need to establish a link relationship between an Azure AD user and the corresponding user in Cloud Academy.

To configure and test Azure AD SSO with Cloud Academy, you'll complete these high-level steps:

  1. Configure Azure AD SSO to enable your users to use the feature.
    1. Create an Azure AD test user to test Azure AD single sign-on.
    2. Grant access to the test user to enable the user to use Azure AD single sign-on.
  2. Configure single sign-on for Cloud Academy on the application side.
    1. Create a Cloud Academy test user as a counterpart to the Azure AD representation of the user.
  3. Test SSO to verify that the configuration works.

Configure Azure AD SSO

Follow these steps to enable Azure AD SSO in the Azure portal:

  1. In the Azure portal, on the Cloud Academy application integration page, in the Manage section, select single sign-on.

  2. On the Select a single sign-on method page, select SAML.

  3. On the Set up Single Sign-On with SAML page, select the pencil button for Basic SAML Configuration to edit the settings:

    Screenshot that shows the pencil button for editing the basic SAML configuration.

  4. In the Basic SAML Configuration section, update the Identifier text box, type the following URLs and proceed:

    Identifier
    urn:federation:cloudacademy

  5. In the Basic SAML Configuration section, update the Reply URL text box, type one of the following URLs and proceed:

    Reply URL
    https://cloudacademy.com/labs/social/complete/saml/
    https://app.qa.com/labs/social/complete/saml/

  6. In the Basic SAML Configuration section, update the Sign-on URL text box, type one of the following URLs and save it:

    Sign-on URL
    https://cloudacademy.com/login/enterprise/
    https://app.qa.com/login/enterprise/

  7. Select the pencil button for SAML Signing Certificate to edit the settings:

    Screenshot that shows how to edit the certificate.

  8. Download the PEM certificate:

    Screenshot that shows how to download the P E M certificate.

  9. On the Set up Cloud Academy section, copy the Login URL:

    Screenshot that shows the copy button for the login U R L.

Create an Azure AD test user

In this section, you create a test user called B.Simon in the Azure portal.

  1. In the left menu of the Azure portal, select Azure Active Directory. Select Users, and then select All users.
  2. Select New user at the top of the screen.
  3. In the User properties, complete these steps:
    1. In the Name box, enter B.Simon.
    2. In the User name box, enter <username>@<companydomain>.<extension>. For example, B.Simon@contoso.com.
    3. Select Show password, and then write down the value that's displayed in the Password box.
    4. Select Create.

Grant access to the test user

In this section, you enable B.Simon to use Azure single sign-on by granting that user access to Cloud Academy.

  1. In the Azure portal, select Enterprise applications, and then select All applications.
  2. In the applications list, select Cloud Academy.
  3. On the app's overview page, in the Manage section, select Users and groups:
  4. Select Add user, and then select Users and groups in the Add Assignment dialog box:
  5. In the Users and groups dialog box, select B.Simon in the Users list, and then click the Select button at the bottom of the screen.
  6. If you're expecting a role to be assigned to the users, you can select it from the Select a role dropdown. If no role has been set up for this app, you see "Default Access" role selected.
  7. In the Add Assignment dialog box, select Assign.

Configure single sign-on for Cloud Academy

  1. In a different browser window, sign in to your Cloud Academy company site as administrator.

  2. On the home page, click the Azure Integration Team icon, and then select Settings in the left menu.

  3. On the INTEGRATIONS tab, select the SSO card.

    Screenshot that shows the Settings & Integrations option.

  4. Select Start Configuring to set up SSO.

    Screenshot that shows the Integrations and S S O page.

  5. On the General Settings page, complete the following steps:

    Screenshot that shows integrations in general settings.

    1. In the SSO URL (Location) box, paste the login URL value that you copied from the Azure portal, in step 9 of Configure Azure AD SSO.

    2. Open the downloaded Base64 certificate from the Azure portal in Notepad. Paste its contents into the Certificate box.

  6. Perform the following steps in the below page:

    Screenshot that shows the Integrations in additional settings.

    1. In the SAML Attributes Mapping section, fill in the required fields with the source attribute values:

      http://schemas.microsoft.com/identity/claims/objectidentifier http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

    2. In the Security Settings section, select the Authentication Requests Signed? check box to set this value to True.

    3. In the Extra Settings(Optional) section, fill the Logout URL box with the logout URL value that you copied from the Azure portal, in step 9 of Configure Azure AD SSO.

  7. Select Save and Test.

  8. Next, a dialog shows the service provider information. Download the XML file:

    Screenshot that shows downloading the metadata configuration file.

  9. Now that you have the XML file of the service provider, go back to the application you created in the Azure portal. In the Single sign-on section, upload the metadata file:

    Screenshot that shows uploading the metadata in the Azure application.

  10. Now that you've updated the service provider metadata, you can go back to the SSO panel of your Cloud Academy company site and proceed with the test and activation. In the service provider dialog, select Continue:

    Screenshot that shows the service provider dialog.

  11. Select Test SSO connection to start the test flow:

    Screenshot that shows the Test S S O connection button.

    Note

    If you're signed in to Cloud Academy by using the test user account you created, proceed with the test flow. Otherwise, close the dialog, scroll up to General Settings, copy and paste the subdomain URL in a private or incognito browser tab, and then sign in as the test user. If sign-in is successful, you can close the browser tab and select Save and Test. A browser tab will reopen the service provider dialog. Select continue, and then select Test SSO connection again. Finally, select Test was successful because you've already tested sign-in by using a private or incognito tab.

    Continue to the next step.

  12. If sign-in is successful, you can activate SSO integration for the entire organization:

    Screenshot that shows S S O activation is successful.

Note

For more information about how to configure Cloud Academy, see Setting Up Single Sign-On.

Create a Cloud Academy test user

In this section, a user called B.Simon is created in Cloud Academy. Cloud Academy supports just-in-time user provisioning, which is enabled by default. There's no action item for you in this section. If a user doesn't already exist in Cloud Academy, a new one is created after authentication.

Cloud Academy also supports automatic user provisioning. For more information, see the Cloud Academy SSO provisioning tutorial.

Test SSO

In this section, you test your Azure AD SSO configuration by using one of the following options:

  • In the Azure portal, select Test this application. You're redirected to the Cloud Academy sign-on URL and you can initiate the sign-in flow.

  • Go to Cloud Academy sign-on URL directly and initiate the sign-in flow from there.

  • You can use Microsoft My Apps. When you click the Cloud Academy tile in the My Apps portal, this will redirect to Cloud Academy sign-on URL. For more information about the My Apps portal, see Introduction to My Apps.

Next steps

After you configure Cloud Academy, you can enforce session control, which protects exfiltration and infiltration of your organization’s sensitive data in real time. Session control extends from Conditional Access. Learn how to enforce session control with Microsoft Cloud App Security.