nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

SAML Authentication for Third Party

khem1000

Hi,

We are looking to migrate our built-in accounts to SAML set up in Azure AD. There is no issue for internal users who have an AD account.

We also have about 300 external contractors, who currently have access but they do not have their own AGOL license. Some of the users only need temporary access for 3-6 months for a specific project.

Do they need to have full account set up in our Azure AD ?

Or does B2B work i.e. are they added as guests in our Azure AD and by doing SAML claims transform in Azure, they can be authenticated using their own IDP?

Can someone please point me to ESRI architecture documentation how the external users can be set up for authentication using SAML.

Are there any recommended option(s) ?

Thanks

Finde mehr Beiträge mit dem Tag

Sharing and collaboration

Accepted answers

ryanuthoff

For the purposes of AGOL, it works exactly the same as an Azure AD account that your organization owns. You invite them to your Azure AD tenant, and then the end user needs to accept the invitation from Microsoft. After that, you just set the permissions just as if it were an account that your organization owns.

Yes, I got this working. This is a common workflow.

Again, you would treat revoking access the same as if it were an account that your organization owns. You delete the account and/or content from AGOL, then delete the account from Azure (or at least remove them from the AGOL enterprise app that gives them access to AGOL).

All comments

khem1000

Thanks for confirming.

This appears straightforward, but I couldn't find any ESRI documentation on using guest accounts.

ryanuthoff

Yes, I got this working. This is a common workflow.

khem1000

Thanks. This sounds quite promising.

I understand the benefit of using guest accounts, but does the SAML assertion provided for the guest users work reliably without needing further customisation in Azure?

Has anyone got this working?

I assume to revoke access, the user simply need to be removed from Azure and their membership and content deleted in AGOL.

ryanuthoff

No, they don't necessarily need full access in your Azure AD tenant. All you need to do is invite them as an external user in Azure AD, which essentially adds them as a guest account in your tenant.

When you invite them as an external user, you do NOT manage their account (so no password resets, no email management, etc.). The contractor's organization is still responsible for that. The only thing you can really control is what they have access to within your Azure tenant (such as giving them permissions to AGOL).

On the AGOL side of things, you would manage it the exact same was as your internal users.

And a final note, you can invite non-Microsoft accounts as well. They work just about the same as Microsoft accounts.

Nimm an der Unterhaltung teil

Angemeldete Mitglieder können Beiträge verfassen, Updates folgen und mehr. Neu hier? Registriere ein kostenloses Konto.

Schnellzugriffe

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.