Password Management with Azure AD Enterprise Applications

The aim was to store passwords for shared web services centrally and to centrally entitle individual users from there without having to hand over their username and password.

The initial situation

Web service/portal with its own user management

We have numerous accesses to web portals and other services, for which we are provided with separate credentials. This includes order portals for office supplies, but also shops of our suppliers, in which not only orders are made, but also reports and reports are stored.

So far, we have always been given access to this and then communicated to the employees who need access. The result is clear, we have of course lost track of the information and no longer knew who was in possession of the access data. When an employee left, we had to change the credentials and the whole thing started all over again.

The task

Single Sign On with Web Applications and Azure AD

The user should log on to his computer and get access to all applications and services shared with him without having to log in again anywhere.

This means that the web service must be connected to Azure AD to take advantage of the capabilities of identity management with Single Sign On.

The solution

Enterprise Applications in Azure AD

In fact, it’s quite easy to create an Enterprise Application in Azure AD that entitle users or a user group, and update the application’s credendials.

The configuration

Configuring Enterprise Applications in Azure AD

In fact, it’s quite easy to create an Enterprise Application in Azure AD that entitle users or a user group, and update the application’s credendials.

To create an enterprise application in Azure Active Directory:

In the Azure Portal, go to Azure Active Directory -> Enterprise Applications there on “New Application”.

Here you can either select an existing one from the gallery or add your own app. In this case, we’ll add a new one.

Then the configuration window for the new Enterprise Application opens.
Under Properties, the name can still be changed and a logo can be uploaded.

Under Users and Groups, individual users or previously created groups can be authorized. Select the group and click Update Credentials to enter the credentials.

Under Single sign-on, enter the login page of the web service.

That was the actual configuration in Azure Active Directory.

In order for the whole thing to be usable, the Extension My Apps Secure Sign must be installed in the browser.

If you now go to the login page of the web service with the browser, then an icon appears in the browser or click on the icon the first time and select the shared Enterprise app. You no longer need to enter access data and will be logged in.

The conclusion

Benefits and Limitations of the Solution

At the very least, there are no restrictions.

If you already use Azure AD, you should definitely use this feature, because it gives you a direct overview of the granted permissions and makes them manageable.

Password Management with Azure AD Enterprise Applications