Connect your Microsoft Entra ID with ePO

You can register a Microsoft Entra ID (Azure ID) with ePO - SaaS Cloud Directory Services to leverage User Based Policy enforcement and synchronize the devices from Microsoft Entra ID to the ePO - SaaS System Tree.

The Hybrid Mode often refers to Hybrid Identity, which synchronizes an on-premise Active Directory (AD) with Entra ID. This allows users to sign in to cloud services, for example Microsoft 365, using their on-premise credentials. If this is the case in the customer environment, users must select the hybrid mode check box.

When you register your organization’s Microsoft Entra ID (Azure AD) with ePO - SaaS you can:

Replicate all Microsoft Entra ID (Azure AD) Users and User groups (Scheduled and On Demand).
Browse and choose Microsoft Entra ID (Azure AD) users in the Policy Assignment pop up and create a user-based policy assignment rule as mentioned in Assigning user-based policies.
Synchronize the devices from Microsoft Entra ID (Azure ID) to the ePO - SaaS System Tree. For more information, see Synchronizing the System Tree with your Active Directory.

Set up credentials on the Azure Portal:

Register an app by following the steps mentioned in Register an application in Microsoft Entra ID.
Copy the values of two fields: Application (client) ID and Directory (tenant) ID. You need them later to create Directory Service in ePO - SaaS.
Select API permissions on the left pane under Manage and click Add a permission.
The Request API permissions page appears:
1. Select Microsoft Graph.
2. What type of permissions does your application require: Select Application permissions.
  Note
  We require Application permissions because our application runs a background service.
3. Use the Select permissions search and select the following:
  1. Device.Read.All
  2. Domain.Read.All
  3. Group.Read.All
  4. GroupMember.Read.All
  5. Organization.Read.All
  6. User.Read.All
  7. Directory.Read.All
4. Click Add Permissions.
5. On the API permissions page, click Grant admin consent for (Tenant Name) and select Yes. This selection gives pre-consent to the application using this registration to access the APIs under the specified permissions. If you signed in as a global administrator, consent is recorded for all users in the tenant that run the application. Otherwise, it applies only to your user account.
In the left pane, select Manage > Certificates & secrets, and click New client secret in the Client secrets tab.
1. Enter the following details:
  1. Description: ePO - SaaS.
  2. Expires: Select the period required. Custom allows for the date range to be specified.
2. Click Add.
3. Copy and save the string generated named Value. The string named Secret ID is not used or needed in this workflow.
  Note
  After you leave the page the value will not be visible again.

Register a Microsoft Entra ID (Azure AD) on ePO - SaaS:

Log in to ePO - SaaS with your credentials.
From Menu, navigate to Configure and choose Directory Service.
Click on New Server and enter a name.
On the Details tab select Microsoft Entra ID (Azure AD) from the Directory Services drop-down menu.
Enter the client credentials obtained from Azure portal.
1. Copy the Directory (tenant) ID to the Tenant GUID field.
2. Copy the Application (client) ID to the Client ID field.
3. Copy the Secret Value string to the Client ID Secret field.
Perform a Test Connection and Save the configuration.

Connect your Microsoft Entra ID with ePO - SaaS