How to use IBM App Connect with Microsoft Azure Active Directory

Connecting to Microsoft Azure Active Directory

Once you have selected your preferred authorization method, to connect App Connect to a Microsoft Azure Active Directory account, you need to provide the following connection details. The instructions about how to create these values are provided after the following table.

To generate these values and connect to Microsoft Azure Active Directory, you'll need to register an application with the required permissions in Microsoft Azure, which will enable App Connect to integrate with Microsoft Azure Active Directory by using APIs and protocols.

1. To register an application with Microsoft Azure, for use with App Connect:
   1. Log in to the Microsoft Azure portal, and then locate and click App registrations. (Direct link for the Azure app registration portal: https://go.microsoft.com/fwlink/?linkid=2083908)
   2. If you have access to more than one tenant, switch to the tenant where you want to register the app by using the Directories + subscriptions filter in the banner and then click the Close icon (X) to return to the previous page.
   3. In the App registrations page, click New registration.
   4. In the Register an application page, specify a unique name for your app, select Accounts in any organizational directory (Any Azure AD directory - Multitenant) as the account type, and accept the default values for the remaining fields.
      
   5. Click Register. The Overview page for the application is displayed.
      
   6. Make a note of the Application (client) ID value because you'll need to specify it as a connection value when creating the account (by using either OAUTH2_PASSWORD or BASIC_OAUTH authorization) in App Connect.

2. To generate a client secret for your registered application:
   1. Next to Client credentials on the Overview page, click Add a certificate or secret. This displays the Certificates & secrets page.
   2. Click New client secret
   3. In the Add a client secret panel, specify a description for the secret (for example, App Connect secret) and then select an expiry period.
   4. Click Add. The generated client secret is displayed on the Certificates & secrets page.
      
   5. In the Add a client secret panel, specify a description for the secret, then select an Expiry periodand click Add
   6. Copy and store the client secret value because you'll need to specify it as a connection value when creating the account (by using either OAUTH2_PASSWORD or BASIC_OAUTH authorization) in App Connect. If you are using BASIC_OAUTH authorization, you'll also need to specify the client secret value while generating access and refresh tokens.
      Note: The client secret value won't be shown again in full after you leave this page.
3. Configure the permissions that App Connect needs.
   1. In the left pane, click API permissions and then click Add a permission > Microsoft Graph > Delegated permissions to add each of the following permissions in turn. You can search for and select a permission, and then click Add permissions.

      Permissions	Description
      Directory.ReadWrite.All	Read and write directory data. (Allows App Connect to read and write data in your organization's directory, such as users, and groups.)
      offline_access	Maintain access to data you have given it access to. (Allows App Connect to see and update the data you gave it access to, even when users are not currently using App Connect.)

      Note: Directory.ReadWrite.All requires admin consent.
   2. If the status of any permission is shown as Not granted for myDomain, click Grant admin consent for myDomain, where myDomain is your domain name. Then click Yes to confirm. (This will update the status of all permissions to Granted for myDomain.)
   
4. If you want to connect by using BASIC_OAUTH authorization, use an application such as IBM API Connect Test and Monitor or Postman to submit a POST request to generate an access token and a refresh token that will be used to interact with Microsoft Azure Active Directory on your behalf. Specify the following parameters:
   • Request URL:

     https://login.microsoftonline.com/organizations/oauth2/v2.0/token

   • Content-Type: application/x-www-form-urlencoded
   • Request parameters:

     Key	Value
     client_id	Set this to the Application (client) ID value that was generated for your registered app.
     scope	Directory.ReadWrite.All offline_access
     grant_type	password
     client_secret	Set this to the client secret value that was generated under Certificates & secrets for your registered app.
     userName	Set this to the username that was used to log in to the Azure portal.
     password	Set this to the associated password for the username

• Example: Using Postman

  Postman Version 7.29.1 was used in these instructions, so there might be a slight variation in the fields that you see if your version is different.

  1. Start a new POST request and specify the request URL.
  2. Click the Body tab and select x-www-form-urlencoded. This option automatically adds the Content-Type: application/x-www-form-urlencoded setting in the request header.
  3. Specify the request parameters.

  

  When you click Send, an access token and refresh token are returned in the response. Make a note of these values because you'll need to specify them as connection values when creating the account.

  

Accessing advanced query capabilities

App Connect provides you with a number of additional properties for the Device, Group and User retrieve objects. When you need to retrieve more information about these objects, for instance more information than what is provided by default, you can access additional properties, known as advanced query capabilities in Microsoft Azure Active Directory by using the following two filter conditions:

Expand references

The expand references field requires the selection of a boolean (true/false) value. To access additional properties, set this field to true.

Note: By default, the value of the Expand references field is set to false.

Navigation properties to expand

Use this field to specify the additional Microsoft Azure Active Directory properties that you want to access. You can choose a maximum of 5 values using a comma-separated list.

For more information about Microsoft Azure Active Directory advanced query capabilities see, Advanced query capabilities on Azure AD directory objects.

General considerations

Events and actions

Microsoft Azure Active Directory events

These events are for changes in this application that trigger a flow to start performing the actions in the flow.

Microsoft Azure Active Directory actions

These are actions on this application that you want a flow to complete.

Devices

Create device

Retrieve devices

Update device

Delete device

Update or create device

Groups

Create group

Retrieve groups

Delete group

Update group

Update or create group

Users

Create user

Retrieve users

Delete user

Update user

Update or create user

More items are available when you have connected App Connect to Microsoft Azure Active Directory.