Configuring Azure AD directory sync
Modified 2 years ago
Kiruthika
You can synchronize user and group information from your third-party directory accounts to Kissflow using the Identity providers feature under User provisioning in Kissflow. We currently support user provisioning from Google Workspace, Microsoft Azure Active Directory.
An account can have only one user provisioning service enabled at a time so if you are currently using SCIM, we recommend you to contact our customer support team to help you disable it.
Prerequisites
- An Azure AD subscription.
- Administrator access in both the Azure and Kissflow accounts used for the directory sync.
Connecting to Azure AD
- Access your Kissflow account on your web browser and click your profile picture > Account Administration > User provisioning > Identity providers > Configure
- Click Connect Azure AD on the Select your identity provider page
- Sign in to your Microsoft Azure AD account with your credentials.
- Your connection might fail if you aren’t an Administrator in your Azure AD account or if the account you tried to sign in wasn’t an Azure AD account.
- Select the Consent on behalf of your organization checkbox to give your consent to let Kissflow access the information required for the user sync from your Azure AD account. This information includes your current role in Azure AD, your email address, domain, and users and groups under your domain.
- Click Accept to let Kissflow access the information needed to connect to your Azure AD account.
Verifying tenant details
A tenant refers to an organization in your Azure AD account. Learn how to create a tenant for your organization in your Azure AD account here. As the first step, verify whether the correct tenant is mapped with your Kissflow account in the Tenant details section. Click Next if the Tenant name and Tenant ID are correct.
Selecting users or groups
After verifying the tenant information, you can choose to sync all the users from the tenant or sync users only from a specific set of groups available in the tenant.
Under User sync,
- Select All users if you would like to add or sync all the users from the tenant mapped with your Kissflow account (or)
- Select Users from specific group(s) and choose the groups if you would like to add or sync users from the tenant.
After selecting users, you can choose to sync their group information by selecting the Add group information additionally checkbox. If you chose to sync users from specific groups, the selected groups will be populated automatically when you check this box. You can make modifications to the list as you wish or leave them as is.
Click Next to proceed or click Previous if you would like to review the tenant information once again.
Mapping and testing field attributes
Testing field mapping helps you spot discrepancies in the data between the source and destination services and avoid sync failures at a later stage.
We will map three mandatory fields - First name, Last name, and Email ID from your Azure AD account with their respective fields in your Kissflow account by default. Click +New field to add as many fields as you want, from your Azure AD account and map them with their equivalent fields in Kissflow.
After mapping fields, you can select certain fields for which you wouldn't want future updates to be synced into Kissflow.
Toggle Sync updates OFF to prevent a field from being updated in the future. However, disabling this field doesn't restrict the field from being added for the first time.
Click Test to preview the mapping results.
Your field mapping might fail in the following scenarios:
- The source and destination fields must have the same data type. For example, you cannot map a ‘Manager name’ field (Text) in Azure AD with a 'Joining date' field (Date) in Kissflow.
- The field values must be in the accepted format. For example, the ‘Joining date’ field (Date) cannot have ‘June sixth’ as one of its values. It must follow the format 06/06/2019 (DD/MM/YYYY) instead.
Resolve the errors if any and retest the mapping as necessary. Click Next to proceed to the next step when you are done testing.
Setting sync preferences
You can schedule sync, manage deleted Azure AD users, and assign notification recipients for sync failures in this section. Kissflow supports scheduled syncs only on a weekly basis at the moment.
- You can choose to delete or deactivate users in Kissflow when they are deleted in your Azure AD account.
- Select the recipients from the Notify sync failures to dropdown to send them notifications in case of sync failure. The users will receive both in-app and email notifications in this regard.
- Click Save & sync now to save your configuration.
