Implement SSO and User Provisioning through Azure Active Directory

Step 1 - Add an application

1. Log into the Azure Portal. Go to Azure Active Directory > Enterprise Applications.
2. Click on New application.

3. Click the Non-gallery application. (You might need to check if this possibility is included in your Azure subscription).

4. Enter a name.
5. Click Add.

Step 2 - Configure single sign-on (SSO)

1. Open the Proxyclick app in Azure Active Directory > Enterprise Applications and go to the Single sign-on section.

2. Select SAML-based Sign-on for Single Sign-on Mode.
3. Go to the Proxyclick Marketplace and install Azure AD.
4. Copy the Identifier and the Reply URL from the Azure AD configuration page and paste them into the corresponding fields in Azure AD.

5. Select user.mail for User Identifier.
6. Click on Save.

7. Download the file Certificate (Base64) and open the Metadata XML to extract the EntityID and SingleSignOnService Location.
8. Go back to the Azure AD configuration page (https://app.proxyclick.com/default/settings/integrations/sso/azuread) and paste them into the corresponding fields from Azure AD. Everything in the certificate file (including the BEGIN and END header and footer) needs to be copied into the Certificate (Base64) field in Proxyclick.

9. Click on Save Changes.

Your Azure AD connection is ready. You can now use the URL in the Identifier field to log into Proxyclick using Azure AD SSO or log into Azure AD as a user and choose the Proxyclick app. But you will still need to add users in Proxyclick before you try to log in with SSO (you can do it manually, in bulk, or via User Provisioning. See next steps to configure User Provisioning with Azure AD).

Step 3 - Configure user provisioning

1. Open the Proxyclick app in Azure Active Directory > Enterprise Applications and go to the Provisioning section.

2. Select Automatic for Provisioning Mode.
3. If not done already, go to the Proxyclick Marketplace and install Azure AD (https://integrations.proxyclick.com/integrations?id=54&alias=azure-ad).
4. Copy the Tenant URL and the Secret Token from the Azure AD configuration page (https://app.proxyclick.com/default/settings/integrations/up/azuread) and paste them into the corresponding fields in Azure AD.

5. Click on Save.
6. After the settings are saved, go to the Mappings section.

7. Click on Synchronize Azure Active Directory Groups to customappsso.

8. Disable group synchronization by selecting No and then click on Save.
9. Close the window to return to the provisioning configuration page.
10. Click on Synchronize Azure Active Directory Users to customappsso.
11. Adapt the attribute mappings:

Azure Active Directory Attributes

Azure Active Directory Attribute	customappsso Attribute	Matching Precedence	Mapping Type
mail	userName	1	Direct
Switch([IsSoftDeleted], , "False", "True", "True", "False")	active		Expression
givenName	name.givenName		Direct
surname	name.familyName		Direct
mail	emails[type eq "work"].value		Direct

12. Click on Save.
13. Close the window to return to the provisioning configuration page and go to the Settings section.

14. Set Provisioning status to On and click Save.

Optional Supported Attributes

The below attributes can additionally be configured to pass more user data to Proxyclick.

• Telephone and Mobile numbers must be in E.164 format
• City can be substituted for any other string-based attribute to use in conjunction with the below settings for multi-location provisioning

Azure Active Directory Attribute	customappsso Attribute	Matching Precedence	Mapping Type
telephoneNumber	phoneNumbers[type eq "work"].value		Direct
mobile	phoneNumbers[type eq "mobile"].value		Direct
city	addresses[type eq "work"].locality		Direct
title	title		Direct
preferredLanguage	preferredLanguage		Direct

Set up for multiple locations

User Provisioning

You can configure Azure AD and manage users across multiple locations from a single Proxyclick account.

1. Connect Azure AD in your main location (follow the steps above)

2. Click on Multi-location mapping on the Azure AD integration in your Integration List

You will then see the list of all the locations for which you are an Admin. You can enable/disable User Provisioning for each location from this list using the toggle button.

When enabled, you can import all users for provisioning in that location or define your filters for specific users.

You can filter users based on their city and language using the appropriate conditions.

Advanced

If you provision the same users in multiple locations, you can use the Advanced menu to force their “home location.” Proxyclick would then use this as the default location for new visits created (e.g. when using the Generic Calendar Integration).

Azure User Provisioning and Single Sign-on require both add-ons.