Introduction:

This article contains information for IT Administrators setting up their organisations Microsoft’s Azure Active Directory service to integrate with FBO One for managing user accounts and passwords for single sign on and multi-factor authentication. 

Note: If you already have the organisation AD set up, read this article for configuring FBO One and mapping users.

Azure Active Directory setup instructions

Create App registration

1. Navigate to the ‘Azure Active Directory’ after login to portal.azure.com

New App registration

1. Navigate to ‘App registrations’ from selected Tenant.

2. Click ‘New registration’ to create a new application registration for FBO One for the directory.

Register an application details

On the ‘Register an application’ screen (after clicking ‘New registration’, add the following details:

1. Name: Name of the App, name as ‘FBO One’ (RECOMMENDED)

2. Supported account types: Choose either:

   1. ‘Accounts in this organizational directory only (Test FBO One only - Single tenant)’ for directory users from single tenants.

   2. ‘Accounts in any organizational directory (Any Azure AD directory - Multitenant)’ for directory users from multiple tenants. RECOMMENDED

3. Redirect URI (optional): Add the following URI, replacing ‘FBOONENAME’ with the name of the FBO One instance:

   1. • Web> https://FBOONENAME.fbo.one/openid/return

4. Click ‘Register’ to register the application.

Add URL - App Authentication

1. Navigate to ‘Authentication’ from the ‘FBO One’ App registration

2. Click ‘Add URI’ in the ‘Web’ area.

3. Add Redirect URI: "https://FBOONENAME.test.fbo.one/openid/return"

4. Click ‘Save’

Select ‘ID tokens' for 'Implicit grant’ - App Authentication

1. Navigate to ‘Authentication’ from the 'FBO One' App registration.

2. Scroll to ‘Implicit grant’ section and enable ‘ID tokens’. Ensure that ‘Access tokens’ is disabled.

3. Click ‘Save’.

Add permissions - API permissions

1. Navigate to ‘API permissions’ from the 'FBO One' App registration.

2. Click ‘Add a permission’ in the ‘Configured permissions’ area.

3. Click ‘Microsoft Graph’ in the ‘Request API permissions’ area.

4. Choose ‘Delegated permissions’ from ‘Microsoft Graph’ area.

5. Find and select permissions:

   • offline_access

   • openid

   • profile

6. Click ‘Add permissions’.

Grant admin consent for App - API permissions

1. Navigate to ‘API permissions’ from the ‘FBO One’ App registration.

2. Click ‘Grant admin consent for FBO One’. Note: The the App name will display here if named differently.

3. Click ‘Yes’ to consent admin permission.

 

When granted, permissions will show ‘Granted for TENANT’:

Related pages:

• How to Enable and Set Up SSO OpenID Directory