Skip to main content

Getting Started with the Illumio Console

Configuring Microsoft Entra ID (Azure AD)

Follow these steps to configure Microsoft Entra ID (formerly known as Microsoft Azure Active Directory) as an external identity provider (IdP) in the Illumio Console's Okta instance via OIDC protocol.

Prerequisites

Ensure that you have entered an email, first name, and last name in your user profile in your Azure AD instance. These fields cannot be empty.

Register Illumio as an application

  1. Log into Entra ID (Azure AD).

  2. In the Azure left navigation panel, click App registrations.

  3. At the App Registrations page, click New registration. 

  4. At the Register an application page:

    1. In the Name field, enter a name for your Illumio Console instance. For example, "MyCorp on Illumio". 

    2. For Supported account types, select Accounts in this organizational directory only (Single tenant) .

    3. Under Redirect URI, choose Single-page application (SPA) and enter the URI to Illumio Console: https://console.illum.io.

  5. Click Register.

Additional configuration

After you have registered your Illumio Console application as an Entra application, you can see it listed when you click App registrations, then All applications.

  1. At the App registrations page, click your application name (for example,"MyCorp on Illumio") to see more details.

  2. At your application details page, click Authentication.

  3. Confirm that you have entered the proper Redirect URI, and correct it if needed.

  4. Under Implicit grant and hybrid flows, you must enable the ID tokens setting.

Save Configuration Parameters

  1. At the details page for your Illumio Console application, click Settings.

  2. Copy the Client ID setting shown there. You will use this as the Client ID setting when completing your OIDC authentication in the Illumio Console.

  3. Copy the Directory (tenant) ID shown here. This ID will be used as the basis for the Issuer URL setting when completing your OIDC authentication in the Illumio Console, where you will enter the URL in the form: https://-login.microsoftonline.com/tenant_ID/v2.0.

  4. Click Manifest, and at this page use the editor to update the following JSON entries to these values: 

    "acceptMappedClaims": true
"accessTokenAcceptedVersion": 2

    Instead of accessTokenAcceptedVersion you might see requestedAccessTokenVersion. Whichever entry is in your manifest, ensure that this entry is set to 2.

Configure tokens

  1. Click Token configuration. At this page:

    1. Select ID Token.

    2. Click Add optional claim. Enable email and upn in the list of claims. If available, also enable the option to Turn on Microsoft Graph email permission.

    3. Click Add.

  2. At the Token configuration page, confirm that both email and upn are listed under the Claim column, and they are Token type of ID.

  3. Click API permissions.

    When you enabled Microsoft Graph earlier, API permissions should be turned on for email and profile.

  4. Click Microsoft Graph under the API/Permissions name column, and enable the openid permission.

    The email and profile permissions should be enabled already.

  5. Click Add.

Custom Claims Mapping

  1. Go to your Entra ID Home, and click Enterprise applications.

  2. From the list of your applications, click the name of your new Illumio Console application (for example, "MyCorp on Illumio").

  3. At the details page for your Illumio Console application, click Properties. Ensure that the Assignment required? option is set to Yes. This setting ensures that when a user logs in, the user is assigned to the target Entra ID application.

  4. Click Single sign-on from the left navigation. At the OIDC-based Sign-on page, under the Attributes and Claims section, click Edit.

  5. On the Manage claim page, enter new claims for firstName and lastName:

    1. Enter the Name (for example, firstName).

    2. Set Source to Attribute.

    3. In Source attribute, choose the menu item user.givenname for thefirstName claim, and user.surname for the lastName claim.

    4. Leave all other options at default values or unspecified.

    5. Click Save after completing each claim.

  6. The next time you log into the Illumio Console, a Microsoft window requests you grant permission. Click Accept.