Focus

SaaS Security Administrator's Guide

Onboarding an App Using Azure AD Credentials

Table of Contents

Onboarding an App Using Azure AD Credentials

To access an administrator account for an app through Azure Active Directory (AD) single sign-on (SSO), SSPM requires your Azure credentials and an MFA secret key that Azure generates.

Depending on the app that you are onboarding, you might have the option to connect SSPM to the app by using administrator credentials. For some apps, you can access the administrator account through Azure Active Directory (AD) single sign on (SSO) instead of using direct authentication to the app.

Connecting to the administrator account through Azure AD provides an extra layer of security, because this onboarding method uses multi-factor authentication (MFA) to access the administrator account. To enable MFA, you configure the Azure AD account to require MFA that uses time-based one-time passcodes (TOTPs). Authenticator apps, such as Microsoft Authenticator or Google Authenticator, generate the TOTPs by using an MFA secret key. The MFA secret key is a shared secret between Azure AD and the authentication app for generating matching passcodes for verification. When you onboard an app using Azure AD credentials, you must provide SSPM with the MFA secret key. Like an authenticator app, SSPM will use the MFA secret key for passcode generation.

In Azure AD, you configure an account to require TOTPs by enabling OATH tokens for the account.

Enable MFA using OATH TOTP for the app administrator's Azure AD account.
1. Open a web browser and navigate to the Azure portal. Log in using an administrator assigned to the Global Admin role. You can log in as the app administrator whose credentials you will supply to SSPM, or as a different administrator.
2. In the Azure portal, navigate to the authentication methods policies page (Authentication methodsPolicies).
3. In the Method list, select Third-party software OATH tokens.
4. On the settings page for third-party software OATH tokens, make sure the method is enabled. Make sure that the app administrator whose credentials you will supply to SSPM is included in the target group for the method.
Generate and copy an MFA secret key.
If the app administrator's account is already configured for MFA, and if you know the MFA secret key value, you don't need to complete the following steps. You need only provide the MFA secret key to SSPM during the onboarding process. If the app administrator's account isn't configured for MFA, complete the following steps. If the app administrator's account is already configured for MFA but you don't know the MFA secret key, reregister the account for MFA and complete the following steps:
1. Decide which authentication app you will use and download it to your cellphone. You can use the Microsoft Authenticator app or another app that supports TOTP generation, such as Google Authenticator.
2. Log in to Microsoft using the app administrator account whose credentials you will supply to SSPM. You can log in from the URL aka.ms/MFASetup. Because MFA using TOTP is now required, the login dialog will notify you that more information is required. Continue to the Next page of the dialog.
3. The login dialog prompts you to configure your cellphone with the Microsoft Authenticator app or with a different authenticator app. If you installed Microsoft Authenticator on your cellphone, continue to the Next page of the dialog. If you installed a different authenticator app on your cellphone, click I want to use a different authenticator app.
4. Follow the onscreen instructions for setting up the authenticator app, but, when you are presented with a QR code that contains the MFA secret key, don't scan it with your authenticator app. Instead, you will first copy the MFA secret key:
  1. On the page of the dialog that displays the QR code, click Can't scan image?.
    The dialog displays the MFA secret key as a character string in addition to the QR code.
  2. Copy the MFA secret key into a text file.
    
    Do not continue to the next step unless you have copied the MFA secret key. You must provide this key to SSPM during the onboarding process.
  3. Continue configuring your authenticator app by scanning the QR code or by manually entering the MFA key. Complete the remaining setup steps as prompted by the dialog.

Onboard a Zoom App to SSPM

Onboarding an App Using Okta Credentials