Objective

• Configuring your Azure AD service and 8x8 Admin Console for Microsoft user SSO login to your 8x8 applications
• Configuring user provisioning (SCIM) from Microsoft Azure AD to 8x8 Admin Console
• User Provisioning Attribute Mappings

Applies To

• 8x8 Admin Console
• Microsoft Azure Active Directory (Azure AD)
• Single Sign-On (SSO)
• User Provisioning (SCIM)

Features

• SSO allows users to authenticate into any 8x8 application using their corporate Azure AD credentials.
• User Provisioning allows:
  • Users from Azure AD to be created in 8x8 automatically without the need to re-key common user details.
  • Updates to user details made in Azure AD to be automatically pushed to 8x8.
  • Deactivation of users in 8x8 by disabling their account in Azure AD.
  • Existing users created directly in Admin Console can be linked to their Azure AD counterparts.

Prerequisites

• Any 8x8 X Series subscription
• Azure Active Directory of any subscription level

Limitations

• Assignment of X Series licenses must still be completed from Admin Console, either individually or in bulk using a CSV upload.
• The user’s phone and extension numbers set in Admin Console cannot be synced back to Azure AD through the 8x8 app. This is due to limitations of Microsoft’s implementation of User Provisioning which does not allow for data to be retrieved back into Azure AD.
• The user's Site cannot be modified once it is set.
• Deleting a user in Azure AD does not delete that user in Admin Console. You must delete the user manually from Admin Console.

Considerations for Existing Deployments

Usernames

Separation of Single Sign-On from User Provisioning

Procedure

Configuring User SSO Login

Add the 8x8 App to Azure

1. Log in to the Azure Active Directory admin center.
2. In Enterprise applications click New application.
   
   
3. In the Azure AD Gallery, search for 8x8. The icon will have a red background with white text. 
   
4. Select the 8x8 app, optionally rename it, and click Create.
5. Configure Single Sign-On by following the instructions below. Note: For reference, Microsoft has an older, less up-to-date article regarding this process, here: Tutorial: Azure AD SSO integration with 8x8.
   
   

Azure SSO Configuration

1. In the Azure Active Directory admin center > Enterprise applications, click on 8x8 and click Single sign-on.
2. Click SAML.
   
   
3. In Basic SAML Configuration, click Edit.
   
   

4. In Identifier (Entity ID), click Add identifier.
5. Add the following URL into the blank field. This entry should be marked as Default, and there should be no other Identifier entries.
   • https://sso.8x8.com/saml2
     
     
6. In the Reply URL box, click Add reply URL.
7. Enter the same URL as for the Identifier. This entry should be marked as Default, and there is no need to modify the Index field.
   • https://sso.8x8.com/saml2
     
     
8. Click Save.

9. Next, in SAML Signing Certificate > Certificate (Base64) click Download, and save the 8x8.cer certificate file onto your computer. You'll apply the certificate later, when configuring Single Sign-On in the 8x8 Admin Console.
   • Critical: Use only the Base64 certificate for configuring Single Sign-On Integration in the 8x8 Admin Console. User single sign-on will fail if you apply other available certificate types.
     
     
10. In Set up 8x8, click on Configuration URLs to expand the section (as needed).
11. Individually click the Copy to clipboard icon for each of the URLs you will use, and paste them into a text editor. You'll need these URLs later, when configuring Single Sign-On Integration in the 8x8 Admin Console.
    • Login URL
    • Azure AD Identifier
    • Logout URL

• https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0

Assigning Azure AD Users

1. In the Azure portal, select Enterprise applications, and then select All applications.
2. In the applications list, click 8x8.
   
   
3. In Manage, click Users and groups.
4. Click Add user/group.
   
   
5. Click None Selected to open the Users and groups selection dialogue.
6. Click on the users and/or groups you wish to log into 8x8 services using SSO.
7. Click Select and then Assign to complete the assignment of the 8x8 app to users/groups.
   
   

8x8 Admin Console Configuration

1. First, log in to the 8x8 Admin Console.
2. From the Home page, click Identity and Security.
   
   
3. In Single Sign-On Integration (SSO), click the slider to enable
   
    SSO integration.
4. Select Microsoft Azure AD.
   
   
5. Now you'll apply the URLs and signing certificate that you previously obtained from the 8x8 app in Azure:
   1. Copy and paste the Azure Login URL to the 8x8 Sign-in page URL field.
   2. Copy and paste the Azure Azure AD Identifier to the 8x8 IDP Issuer URL/URN field.
   3. (Optional) Copy and paste the Azure Logout URL to the 8x8 Sign-out page URL field.
   4. In Certificate in use, click on Click to attach and select the Base64 certificate file that you previously downloaded from Azure.
   5. Click Save to apply your 8x8 SSO configuration.

• https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0

User Provisioning Configuration (SCIM)

8x8 Admin Console

1. First, log in to the 8x8 Admin Console.
2. From the Home page, click Identity and Security.
   
3. In User Provisioning Integration (SCIM), click the slider to enable
   
    SCIM integration.
4. Select Microsoft Azure AD.
5. In the Microsoft Azure AD User Provisioning section, click the Copy button
   
    for each of the following sections and paste the copied information into a text editor. You'll apply this information in Azure to enable provisioning of users to 8x8:
   • 8x8 URL
   • 8x8 API Token
     
6. Click Advanced settings to expand that section.
7. Click the drop-down menu and select the appropriate user retrieval option:
   • All users
     • Retrieves users created in and synced from Azure and users created directly in 8x8 Admin Console, thereby allowing Azure to take control of 8x8 user profiles if the login IDs in both locations are identical.
   • Only users created by the identity provider
     • Limits user retrieval to only those users created in and synced from Azure.
       
8. Click Save to complete your changes in the 8x8 Admin Console.

Azure Active Directory

1. Return to the Azure Active Directory admin center.
2. Navigate to the Provisioning blade of your installed 8x8 app.
   
3. Click Get started.
   
   
4. Change the Provisioning Mode to Automatic.
5. Paste the 8x8 URL value you copied from 8x8 Admin Console in the previous section into the Tenant URL field.
6. Paste the 8x8 API Token value you copied from 8x8 Admin Console in the previous section into the Secret Token field.
   
   
7. Click Test Connection. You should receive a success confirmation message.
8. Click Save to complete this configuration.
   
   

1. Initial deletion is a soft-delete which moves the user to the “Deleted users” blade in Azure AD. This causes the user to be deactivated in 8x8 (This is similar to blocking sign-in from Azure AD).
2. When a user is fully deleted from Azure AD, nothing further happens to the 8x8 user. If the user had not already been deactivated, then the user is deactivated at this point, but not deleted. It is not possible to delete an 8x8 user via the integration, you need to do this individually in Admin Console.

• Username
• First name
• Last name
• Email address
• Deactivation and Activation

• Their Username in Admin Console matches their User name (userPrincipalName) in Azure AD.
• Upon initial assignment to the 8x8 app, Azure AD checks if the user’s attributes are in sync and updates the 8x8 user accordingly. At this point, Admin Console considers the user to be owned by Azure AD and prevents any changes to those attributes that are mapped from Azure AD. This restriction avoids data inconsistency by enforcing that changes are only made to the master data source of the user.

• Company directory of 8x8 Work for Desktop and Mobile
• Contact Center directory
• Switchboard Pro directory

User Provisioning Attribute Mappings

Default attribute mappings

Advanced attribute mappings