Set up an Azure Active Directory integration

C1 provides identity governance and just-in-time provisioning for Azure Active Directory. Integrate your Azure AD instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access.

A newer version of this connector is available.* Azure Active Directory is now Microsoft Entra ID. If you’re setting up this integration for the first time, go to Entra ID integration to get started.

Capabilities

• Sync user identities from Azure AD to C1

• Resources supported:

  • Groups
  • User roles
  • Application roles

• Provisioning supported:

  • Application assignment
  • Group membership
  • Role assignment

Add a new Azure AD connector

This task requires either the Connector Administrator or Super Administrator role in C1.

1. In C1, navigate to Apps > Connectors.

2. Search for Azure AD and click Add.

3. Choose where to add the connector: Create a new app, or Add to an existing app (then select the app).

   If you’re creating a new app, choose whether to link it to an application discovered from your identity provider: select Yes and pick the IdP application, or No to continue with just the connector.

4. Set the connector’s Name and, optionally, a Description.

5. Click the pencil icon next to Owners to choose who can configure and manage this connector.

   A Azure AD connector owner must have the following permissions:

   • Connector Administrator or Super Administrator role in C1
   • Global Administrator in Azure AD
6. Click Add. The connector is created and its configuration page opens.

Next steps

Proceed to Integrate your Azure AD instance for instructions on integrating Azure AD with C1.

Integrate your Azure AD instance

A user with the Connector Administrator or Super Administrator role in C1 and the Global Administrator permission in Azure AD must perform this task.

Step 1: Log in with OAuth

1. In C1, navigate to the Azure AD connector by either:

   • Clicking the Set up connector link in the email you received about configuring the connector.

   • Navigate to Connectors > Azure Active Directory (if there is more than one Azure Active Directory listed, click the one with your name listed as owner and the status Not connected).

2. Click Login with OAuth.

3. Log in and authorize C1 with your Azure AD instance.

   In order for the integration to work properly, you must consent to all permissions:

Step 2: Grant permissions to the C1 app

1. In the Azure AD control panel, go to Enterprise Applications.

2. Click the C1 Integration app (not to be confused with the C1 SSO app, which is used to log into C1, not to synchronize your data).

   If the C1 Integration app doesn’t appear in the list of apps right away, wait a minute and click Refresh.

3. On the C1 Integration page, click Permissions on the left side.

4. Click Grant admin consent for … on the C1 Integration app permissions page.

Step 3: Complete integration

1. Return to the Azure AD integration in C1 by clicking the Azure Active Directory tile on the Integrations page.

2. Click the Azure Active Directory connector link that shows today’s date in the Connected on column.

3. Click Login with OAuth a second time to complete the process and authorize C1 to obtain an access token with the permissions you’ve just granted.

Done. Your Azure Active Directory connector is now pulling access data into C1.

What’s next?

If Azure Active Directory is your company’s identity provider (meaning that it is used to SSO into other software), the integration sync will automatically create applications in C1 for all of your SCIMed software. Before you move on, review the Create applications page for important information about how to set up integrations with the SCIMed apps.