Tutorial: Configure Cornerstone OnDemand for automatic user provisioning

Article
03/16/2023

This tutorial demonstrates the steps to perform in Cornerstone OnDemand and Azure Active Directory (Azure AD) to configure Azure AD to automatically provision and deprovision users or groups to Cornerstone OnDemand.

Warning

This provisioning integration is no longer supported. As a result of this, the provisioning functionality of the Cornerstone OnDemand application in the Azure Active Directory Enterprise App Gallery will be removed soon. The application's SSO functionality will remain intact. Microsoft is working with Cornerstone to build a new modernized provisioning integration, but there are no timelines on when this will be completed.

Note

This tutorial describes a connector that's built on top of the Azure AD user provisioning service. For information on what this service does, how it works, and frequently asked questions, see Automate user provisioning and deprovisioning to software-as-a-service (SaaS) applications with Azure Active Directory.

Prerequisites

The scenario outlined in this tutorial assumes that you have:

An Azure AD tenant.
A Cornerstone OnDemand tenant.
A user account in Cornerstone OnDemand with admin permissions.

Note

The Azure AD provisioning integration relies on the Cornerstone OnDemand web service. This service is available to Cornerstone OnDemand teams.

Add Cornerstone OnDemand from the Azure Marketplace

Before you configure Cornerstone OnDemand for automatic user provisioning with Azure AD, add Cornerstone OnDemand from the Marketplace to your list of managed SaaS applications.

To add Cornerstone OnDemand from the Marketplace, follow these steps.

In the Azure portal, in the navigation pane on the left, select Azure Active Directory.
Go to Enterprise applications, and then select All applications.
To add a new application, select New application at the top of the dialog box.
In the search box, enter Cornerstone OnDemand and select Cornerstone OnDemand from the result panel. To add the application, select Add.

Assign users to Cornerstone OnDemand

Azure Active Directory uses a concept called assignments to determine which users should receive access to selected apps. In the context of automatic user provisioning, only the users or groups that were assigned to an application in Azure AD are synchronized.

Before you configure and enable automatic user provisioning, decide which users or groups in Azure AD need access to Cornerstone OnDemand. To assign these users or groups to Cornerstone OnDemand, follow the instructions in Assign a user or group to an enterprise app.

Important tips for assigning users to Cornerstone OnDemand

We recommend that you assign a single Azure AD user to Cornerstone OnDemand to test the automatic user provisioning configuration. You can assign additional users or groups later.
When you assign a user to Cornerstone OnDemand, select any valid application-specific role, if available, in the assignment dialog box. Users with the Default Access role are excluded from provisioning.

Configure automatic user provisioning to Cornerstone OnDemand

This section guides you through the steps to configure the Azure AD provisioning service. Use it to create, update, and disable users or groups in Cornerstone OnDemand based on user or group assignments in Azure AD.

To configure automatic user provisioning for Cornerstone OnDemand in Azure AD, follow these steps.

Sign in to the Azure portal. Select Enterprise applications > All applications > Cornerstone OnDemand.
In the applications list, select Cornerstone OnDemand.
Select the Provisioning tab.
Set Provisioning Mode to Automatic.
Under the Admin Credentials section, enter the admin username, admin password, and domain of your Cornerstone OnDemand's account:
- In the Admin Username box, fill in the domain or username of the admin account on your Cornerstone OnDemand tenant. An example is contoso\admin.
- In the Admin Password box, fill in the password that corresponds to the admin username.
- In the Domain box, fill in the web service URL of the Cornerstone OnDemand tenant. For example, the service is located at https://ws-[corpname].csod.com/feed30/clientdataservice.asmx, and for Contoso the domain is https://ws-contoso.csod.com/feed30/clientdataservice.asmx. For more information on how to retrieve the web service URL, see this pdf.
After you fill in the boxes shown in Step 5, select Test Connection to make sure that Azure AD can connect to Cornerstone OnDemand. If the connection fails, make sure that your Cornerstone OnDemand account has admin permissions and try again.
In the Notification Email box, enter the email address of the person or group to receive the provisioning error notifications. Select the Send an email notification when a failure occurs check box.
Select Save.
Under the Mappings section, select Synchronize Azure Active Directory Users to Cornerstone OnDemand.
Review the user attributes that are synchronized from Azure AD to Cornerstone OnDemand in the Attribute Mappings section. The attributes selected as Matching properties are used to match the user accounts in Cornerstone OnDemand for update operations. To save any changes, select Save.
To configure scoping filters, follow the instructions in the scoping filter tutorial.
To enable the Azure AD provisioning service for Cornerstone OnDemand, in the Settings section, change Provisioning Status to On.
Define the users or groups that you want to provision to Cornerstone OnDemand. In the Settings section, select the values you want in Scope.
When you're ready to provision, select Save.

This operation starts the initial synchronization of all users or groups defined in Scope in the Settings section. The initial sync takes longer to perform than later syncs. They occur approximately every 40 minutes as long as the Azure AD provisioning service runs.

You can use the Synchronization Details section to monitor progress and follow links to the provisioning activity report. The report describes all the actions performed by the Azure AD provisioning service on Cornerstone OnDemand.

For information on how to read the Azure AD provisioning logs, see Reporting on automatic user account provisioning.

Connector limitations

The Cornerstone OnDemand Position attribute expects a value that corresponds to the roles on the Cornerstone OnDemand portal. To get a list of valid Position values, go to Edit User Record > Organization Structure > Position in the Cornerstone OnDemand portal.

Cornerstone OnDemand Provisioning Edit User Record