Azure Portal configuration guide for Microsoft authentication

Configure Azure and Devolutions Server properly to use Microsoft authentication by following the instructions below.

Requirements

• Devolutions Server scheduler installed and running
• A Microsoft Azure AD subscription
• An Azure AD web application for the Devolutions Server web application and the cache

Creation of Azure AD applications and Devolutions Server Microsoft configuration

To simplify the configuration steps and to easily copy and paste all the required parameters, keep the Devolutions Server and Azure Portal web pages open side by side throughout the whole process.

In Devolutions Server

1. Log in to your Devolutions Server and navigate to Administration – Server settings – Authentication.
2. Under Authentication modes, ensure Authenticate with Microsoft user is enabled.
3. Under Configuration, click on Microsoft authentication.

   

In the Azure Portal

4. Log in to your Microsoft Azure Portal using administrator credentials.
5. Once logged in, select Microsoft Entra ID in the Azure services section. If you do not see it, click on More services to make other services appear or search for it in the search bar.

   

6. In Properties, copy the Tenant ID value.

   

In Devolutions Server

7. Paste this value in the Tenant ID field of the Devolutions Server Microsoft Authentication configuration page.

   The Use specific client ID for users and user groups cache option should only be check to support configurations when migrating from an older Devolutions Server version.

   

In the Azure Portal

8. In the Manage menu section, click App registrations then New registration.

   

9. Enter a significant name for the application. This name will not be used outside of the Azure Portal.
10. Set which Supported account types are allowed to connect. Usually, selecting Accounts in this organizational directory only is more than enough for your Azure AD authentication.
11. Set the Redirect URI to Web and enter a valid URL, the URL to reach your Devolutions Server instance, with /api/external-provider-response at the end.

    

12. Click on Register.
13. Click on Copy to clipboard next to Application (client) ID.

    

In Devolutions Server

14. Paste the Application (client) ID in the Client ID field.

    

In the Azure Portal

15. In the Authentication section, under Implicit grant and hybrid flows, enable Access tokens and ID tokens.

    

16. Click Save.
17. In the Certificates & secrets section, click New client secret.

    

18. Enter a description and set an expiry date.

    

19. Click Add.
20. Copy the Value. Be sure to save the Value in a safe place before switching to another Azure Portal page, as the copy button will no longer be available.

    

In Devolutions Server

21. Ensure the Use only the TokenID for authentication setting is disabled. This setting should only be activated if you have enabled ID tokens in Azure, but not access tokens, for retrocompatibility reasons.
22. Paste the Value in the Secret value field.

    

In the Azure Portal

23. In the API permissions section, click on Add a permission.

    

24. Select Microsoft Graph.

    

25. Select Application permissions.

    

26. Select Group.Read.All under the Group section and User.Read.All under the User section.

    

    

27. Click on Add permissions.
28. Click the three dots next to the User.Read permission and remove it.

    

29. Confirm the removal by clicking Yes, remove since this permission is not required for the sync application.
30. If the Status of the User.Read.All and Group.Read.All permissions is set to Not granted, an administrator must grant consent. If the account used to create the application is already an administrator in Azure, click on Grant admin consent for <your organization>.

    

In Devolutions Server

31. Click Save.

You should now be able to use the Microsoft button on the web interface.

Following the login process, you may get a prompt to authorize the application to read the user accounts and groups. Check the Consent on behalf of your organization box then click Accept.