Create an Azure AD PAM provider

The following guide provides steps to create an Azure AD user PAM provider for Devolutions Server.

In the Azure Portal

1. In a browser page, open the Microsoft Azure AD Portal and sign in to your account.
2. Select Microsoft Entra ID in the Azure Services section. If you do not see it, click on More services to make other services appear.

3. In App registrations, click on New registration.

4. Set the Name of your application.
5. Click Register at the bottom when done.

In Devolutions Server

6. Connect to your Devolutions Server.
7. Go to Administration – Privileged Access – Providers, then click on Add.

8. Select Azure AD User as the new PAM provider, then click Continue.

9. In the Provider window, enter a Name (mandatory) and a Description (optional) for your new Azure AD User PAM Provider. If need be, select a Password template in the drop-down list.

In the Azure Portal

10. In the Overview of your new app registration, copy the Directory (tenant) ID.

In Devolutions Server

11. Paste the ID copied in the previous step in the Tenant ID field.

In the Azure Portal

12. Still in the Overview of your new app registration, copy the Application (client) ID.

In Devolutions Server

13. Paste the ID copied in the previous step in the Client ID field.

In the Azure Portal

14. In Certificates & secrets, click on Client secrets, then on New client secret.

15. In the Add a client secret window, enter a Description and select an expiration date for this client secret, as per your best internal security practices.

16. Click Add.
17. Copy the Value of this new client secret by clicking on the Copy to clipboard icon next to it.

In Devolutions Server

18. Paste the value copied in the previous step in the Secret key field.

19. Test the connection to see if it works, then click Save. The Scan Configuration window will appear: keep it open as it will be filled in a later step.

In the Azure Portal

20. In API permissions, click Add a permission.

21. In the Resquest API permissions window, select Microsoft Graph.

22. Click Application permissions, then check the boxes next to the following Microsoft Graph API permissions to select them:

    • Group.Read.All
    • RoleManagement.Readwrite.Directory
    • User.Read.All

    

23. When all the above permissions have been selected, click Add permissions at the bottom.
24. The list of permissions will be updated to include those just selected. Remove any other unnecessary permissions using the ellipsis button next to them.

25. The permissions require admin consent. Click on the Grant admin consent for < Your Organization > button, then click Yes to confirm.

26. To confirm that the admin consent has been granted, check the Status of your permissions.

27. To grant the application the ability to rotate passwords, leave the App registrations to go back to Azure Active Directory, then select Roles and administrators in the left menu.
28. In All roles, click on the Helpdesk Administrator role. If the accounts managed by the PAM module are members of any administrator roles or group –or if Privileged Identity Management (PIM) is used–, then the application needs the Privileged Authentication Administrator role.

29. In Assignments, click on the Add assignments button.

30. Filter the list to find the Azure application previously created, select it, then click Add.

Your new assignment should now be displayed in Assignments.

In Devolutions Server

31. The last steps are dedicated to configuring a scan for this provider. In the Scan Configuration window that appeared when you saved your provider configuration in step 19, under General, enter a Name for this configuration.

32. Under Configuration, select Groups or Roles in the Search mode drop-down list. You can filter the Search mode for specific Azure AD groups or roles by clicking on the Edit button next to the drop-down list.

33. Click OK when the configuration is done.
34. In Devolutions Server, go to Administration – Privileged Access – Scan Configurations. If the Start Scan on Save option was left enabled during the scan configuration, the scan should have started by itself. During the process, the Status column displays an hourglass icon next to the scan entry.

35. When the process is complete, the hourglass icon changes to a green check mark. At that point, select accounts and import them into the privileged accounts like any other type of privileged account.