QRadar: Configure Microsoft Azure Active Directory as Identity Provider (IdP) for basic authentication

Steps

1. Log in to the Azure AD portal as an administrator.

2. Expand the navigation menu (  ), then click Azure Active Directory.

   
   
3. Click Add, then Enterprise applications.
   
4. Click Create your own application.
   Note: QRadar is not listed as an existing application.
   
5. Give a descriptive application name and select Integrate any other application you don't find in the gallery (Non-gallery).
   Note: In this technote, QradarSAML is the application name.
   
6. Wait until the application is created. After it is created, a management page is displayed.
   Note: The application might take a few minutes to be created.
   
   Result
   The application is created and you can proceed to configure it.
    

1. In left navigation pane, click Single Sign-on and select SAML.
   
2. Click Edit, specify the following values in the settings, and save the changes. In this technote, the Console's FQDN is qradar-console01.test.local.
   1. Identifier: Type the QRadar Console's URL such as https://<Console FQDN>/console.
   2. Reply URL: Type the QRadar Console's URL such as https://<Console FQDN>/console/SAMLSSOAssertionConsumerService.
      
3. Assign the users and groups entitled to use the application.
   1. Click Overview, and select Assign users and groups.
      
   2. Click Add user/group.
      
   3. Click None Selected.
   4. Search the required users and groups. In this technote, luis role is used in the example image.
   5. Click Select.
   6. Click Assign to add the users and groups to be entitled.
      
4. Click Enterprise Application, and select the recently created application. In this technote, QradarSAML is the application name.
5. Scroll down until SAML certificate and download the Federation Metadata XML file.
   Result
   Azure AD is ready to be integrated with IBM QRadar®.