Azure AD Federation

An Azure AD Federation should be setup as OpenID Connect federation. SAML might be possible but is not the preferred configuration.

1. Create an App registration in Azure AD (tab App Registrations)

2. Configure Supported Account types. The value should be “Only Account from this AD” (single tenant).

   1. Azure AD: https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-convert-app-to-be-multi-tenant

3. Add a redirect URI to the App Registration. The redirect URI will be the following with a replacement for our okta domain: https://<our-okta-domain>/oauth2/v1/authorize/callback

   1. For Production: https://access.questback.com/oauth2/v1/authorize/callback

4. Add permission for “UserRead” to that App Registration.

   1. The value will be https://graph.microsoft.com/User.Read

5. Add optional claims to the manifest of the created App Registration in Azure AD. The family_name and the given_name have to be sent.

6. Create a secret for that App Registration and remember it.

7. Remember the client ID of that App Registration.

 "optionalClaims": {
    "idToken": [
        {
            "name": "family_name",
            "essential": true
        },
        {
            "name": "given_name",
            "essential": true
        }
    ]
},
"accessToken": [],
"saml2Token": []