Skip to content

Commit

Permalink
Update Azure AD -> Entra ID in SAML/SCIM docs (#13741)
Browse files Browse the repository at this point in the history
Updates the references to Azure Active Directory to its current name,
Microsoft Entra ID. Also updates the images for setting up SAML using
Entra since they were pretty outdated.
  • Loading branch information
isabeldepapel authored Jan 6, 2025
1 parent ac50c78 commit 1de3ada
Show file tree
Hide file tree
Showing 20 changed files with 50 additions and 54 deletions.
2 changes: 1 addition & 1 deletion content/docs/pulumi-cloud/access-management/saml/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ If you're a member of a SAML-based Pulumi organization, you can sign in to [your

If you're looking to integrate Pulumi with your SAML 2.0 identity provider, refer to one of our example guides:

- [Azure Active Directory](aad/)
- [Microsoft Entra ID (formerly Azure Active Directory)](entra/)
- [Google Workspace (formerly G Suite)](gsuite)
- [Okta](okta/)
- [Auth0](auth0/)
Expand Down
Original file line number Diff line number Diff line change
@@ -1,46 +1,42 @@
---
title_tag: Configuring Azure Active Directory | SAML SSO
meta_desc: This page provides a walkthrough important aspects of configuring
Azure Active Directory (Azure AD) as a SAML SSO identity provider (IDP).
title: Azure AD
h1: "SAML: Configuring Azure Active Directory"
title_tag: Configuring Microsoft Entra ID | SAML SSO
meta_desc: This page provides a walkthrough important aspects of configuring
Entra ID as a SAML SSO identity provider (IDP).
title: Microsoft Entra ID
h1: "SAML: Configuring Microsoft Entra ID"
meta_image: /images/docs/meta-images/docs-meta.png
menu:
cloud:
name: Azure AD
name: Entra ID
parent: pulumi-cloud-access-management-saml
weight: 3
identifier: pulumi-cloud-access-management-saml-aad
identifier: pulumi-cloud-access-management-saml-entra
aliases:
- /docs/reference/service/saml-aad/
- /docs/console/accounts/saml/aad/
- /docs/guides/saml/aad/
- /docs/pulumi-cloud/access-management/saml/aad/
---

This guide walks you through configuring your Azure Active Directory (Azure AD) as a SAML SSO identity provider
This guide walks you through configuring Microsoft Entra ID as a SAML SSO identity provider
(IDP) for the Pulumi Cloud.

## Prerequisites

- [Single Sign-On](/docs/pulumi-cloud/access-management/saml/sso/)

## Configuring Azure AD
## Configuring Microsoft Entra ID

### Add an application to your Azure AD tenant
### Add an application to your Entra ID tenant

1. In the Azure portal, on the left navigation panel, select **Azure Active Directory**.
1. In the Azure portal, on the left navigation panel, select **Microsoft Entra ID**.

1. Select **Enterprise applications**. It will show some of the existing applications in your Azure
AD tenant.

![Enterprise applications section](/images/docs/reference/service/saml-aad/enterprise-applications.png)

1. Select **New application**.
1. Select **Add** then in the dropdown, select **Enterprise application**. It will take you to the Microsoft Entra Gallery.

![New application](/images/docs/reference/service/saml-aad/new-application.png)

1. Select **Non-gallery application** tile and in the **Add your own application** panel, enter
_Pulumi Cloud_ as the application name then select **Add**.
1. Select **Create your own application** and in the **Create your own application** panel, enter
_Pulumi Cloud_ as the application name. Make sure the **Non-gallery** option is selected, then select **Create**.

![Non-gallery application](/images/docs/reference/service/saml-aad/non-gallery-application.png)

Expand All @@ -53,7 +49,7 @@ This guide walks you through configuring your Azure Active Directory (Azure AD)

![SAML configuration](/images/docs/reference/service/saml-aad/saml-configuration.png)

### Enter Pulumi configuration into your Azure AD application
### Enter Pulumi configuration into your Entra ID application

{{< saml-warning >}}

Expand All @@ -67,11 +63,11 @@ This guide walks you through configuring your Azure Active Directory (Azure AD)

### Configure the name identifier format

1. Select the **Edit** icon on the **User Attributes & Claims** panel.
1. Select the **Edit** icon on the **Attributes & Claims** panel.

![User Attributes & Claims Panel](/images/docs/reference/service/saml-aad/attributes-and-claims-panel.png)

1. Then, select the **Edit** icon next to **Name identifier value**.
1. Then, select **Unique User Identifier (Name ID)** under **Required claim**.

![User Attributes & Claims](/images/docs/reference/service/saml-aad/attributes-and-claims.png)

Expand All @@ -85,19 +81,19 @@ This guide walks you through configuring your Azure Active Directory (Azure AD)
<br />
> **Note:** Be sure to assign users and groups to use your new _Pulumi Cloud_ SAML application.
> That is how you can control membership access to your Pulumi organization. See the
> [Azure AD documentation](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-single-sign-on-non-gallery-applications#assign-users-and-groups-to-your-saml-application)
> [Entra ID documentation](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/assign-user-or-group-access-portal)
> for more information.
Now that the Azure AD-side of the SAML SSO configuration is complete, you will need
Now that the Entra ID side of the SAML SSO configuration is complete, you will need
to configure the Pulumi Cloud to receive SAML SSO requests from your
Azure AD.
Entra ID application.

## Configuring Your Pulumi Organization

To configure your Pulumi organization to accept SAML SSO requests from Azure AD, you will need to
To configure your Pulumi organization to accept SAML SSO requests from Entra ID, you will need to
download the SAML application's configuration data and then pass that to Pulumi.

1. Back on the Azure AD's application settings page, select the **SAML Signing Certificate** panel.
1. Back on the Entra ID application's settings page, select the **SAML Certificates** panel.
Then select **Download** next to **Federated Metadata XML** and save the resulting file.

![Download XML](/images/docs/reference/service/saml-aad/download-xml.png)
Expand All @@ -107,25 +103,24 @@ download the SAML application's configuration data and then pass that to Pulumi.

1. Select the **Change Requirements** button and then **SAML SSO**.

1. Open up the XML document you downloaded from the Azure AD portal, and paste its full contents
into the **Identity Provider Metadata** field.
1. Open up the XML document you downloaded from the Entra ID portal, and paste its full contents into the text box.

![Provide the XML IDP descriptor](/images/docs/reference/service/saml-aad/pulumi-saml-settings-page.png)

1. Select **Save**.
1. Select **Apply changes**.

## Signing into Pulumi using Azure AD
## Signing into Pulumi using Entra ID

Once your Azure AD application is created, and its configuration data passed to Pulumi, you can now
Once your Entra ID application is created, and its configuration data passed to Pulumi, you can now
sign in to the Pulumi Cloud using your SAML SSO credentials.

Navigate to [https://app.pulumi.com/signin/sso/](https://app.pulumi.com/signin/sso/) and enter the
name of your Pulumi organization. If everything is configured correctly, you should be prompted to
sign in to your Azure AD instance, and then immediately be redirected back to the Pulumi Cloud.
sign in to your Entra ID instance, and then immediately be redirected back to the Pulumi Cloud.

![Pulumi Cloud](/images/docs/reference/service/saml-aad/pulumi-console-signin.png)

## Troubleshooting

If you have any trouble configuring Azure AD, signing into Pulumi, or need additional assistance, please
If you have any trouble configuring Entra ID, signing into Pulumi, or need additional assistance, please
[contact support](https://support.pulumi.com/).
2 changes: 1 addition & 1 deletion content/docs/pulumi-cloud/access-management/saml/sso.md
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ with the [Pulumi Cloud](/docs/pulumi-cloud/).

> For a specific example, refer to one of our integration guides:
>
> - [Azure Active Directory](/docs/pulumi-cloud/access-management/saml/aad/)
> - [Microsoft Entra ID](/docs/pulumi-cloud/access-management/saml/entra/)
> - [Google Workspace](/docs/pulumi-cloud/access-management/saml/gsuite/)
> - [Okta](/docs/pulumi-cloud/access-management/saml/okta/)
> - [Auth0](/docs/pulumi-cloud/access-management/saml/auth0/)
Expand Down
2 changes: 1 addition & 1 deletion content/docs/pulumi-cloud/access-management/scim/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ If desired, in addition to the SCIM-managed teams, one can also configure and ma

To set up synchronization between Pulumi and your SAML 2.0 identity provider, refer to one of our example guides:

- [Azure Active Directory](/docs/pulumi-cloud/access-management/scim/azuread/)
- [Microsoft Entra ID (formerly Azure Active Directory)](/docs/pulumi-cloud/access-management/scim/entra/)
- [Okta](/docs/pulumi-cloud/access-management/scim/okta/)
- [OneLogin](/docs/pulumi-cloud/access-management/scim/onelogin/)
- [FAQ](/docs/pulumi-cloud/access-management/scim/faq/)
Original file line number Diff line number Diff line change
@@ -1,17 +1,18 @@
---
title_tag: Configuring Azure Active Directory | SCIM
meta_desc: This page describes how to support SCIM 2.0 functionality between Pulumi and Azure AD.
title: Azure AD
h1: "SCIM: Configuring Azure Active Directory"
title_tag: Configuring Microsoft Entra ID | SCIM
meta_desc: This page describes how to support SCIM 2.0 functionality between Pulumi and Entra ID.
title: Microsoft Entra ID
h1: "SCIM: Configuring Microsoft Entra ID"
meta_image: /images/docs/meta-images/docs-meta.png
menu:
cloud:
name: Azure AD
name: Entra ID
parent: pulumi-cloud-access-management-scim
weight: 1
identifier: pulumi-cloud-access-management-scim-azuread
identifier: pulumi-cloud-access-management-scim-entra
aliases:
- /docs/guides/scim/azuread/
- /docs/pulumi-cloud/access-management/scim/azuread
---

This document outlines the steps required to configure automatic provisioning/deprovisioning of your users in Pulumi using SCIM 2.0.
Expand All @@ -26,7 +27,7 @@ Please note that some advanced SCIM features aren't supported yet. For more info

## Enabling Automatic Provisioning

1. Navigate to the Azure Active Directory where you have configured Single Sign On using SAML with Pulumi.
1. Navigate to the Microsoft Entra ID application where you have configured Single Sign On using SAML with Pulumi.
2. Select **Enterprise Applications** and select the app in which you configured Single Sign On with Pulumi earlier.
3. Select the **Provisioning** feature, and change the value of **Provisioning Mode** to **Automatic**.

Expand All @@ -45,7 +46,7 @@ Select **Test Connection**. You should get a success notification once the conne

### Mappings

Make sure the **Provision Azure Active Directory _Users_** mapping is enabled.
Make sure the **Provision Microsoft Entra ID _Users_** mapping is enabled.

{{% notes "info" %}}
If you are not yet ready to enable provisioning for Groups, disable that.
Expand All @@ -55,7 +56,7 @@ If you are not yet ready to enable provisioning for Groups, disable that.

### Adjust User Attribute Mappings

Update the mapping for **userName** so that is applied **Only during object creation**. In the **Mappings** expansion panel, click **Provision Azure Active Directory _Users_** and then click on the corresponding attribute mapping as shown below.
Update the mapping for **userName** so that is applied **Only during object creation**. In the **Mappings** expansion panel, click **Provision Microsoft Entra ID _Users_** and then click on the corresponding attribute mapping as shown below.

In the configuration window, change the value of the **Apply this mapping** drop-down to **Only during object creation**.

Expand Down Expand Up @@ -90,7 +91,7 @@ You are now done with the Mappings configuration. Click **Save** and close the c

## Enable Group Provisioning

To enable the provisioning of Azure AD groups to Pulumi Cloud, select **Edit Provisioning** and then select the **Provision Azure Active Directory Groups** setting under the **Mappings**
To enable the provisioning of Entra ID groups to Pulumi Cloud, select **Edit Provisioning** and then select the **Provision Microsoft Entra ID Groups** setting under the **Mappings**
expansion panel and switch the **Enabled** setting to **Yes**.

### Update Group Attribute Mappings
Expand All @@ -100,18 +101,18 @@ between `objectId` and `externalId`. Click **Save** once you are done.

## Enable Provisioning

Under the **Settings** expansion panel, the **Scope** drop-down should be set to **Sync only assigned users and groups**. This ensures that only the users who are assigned to this application are synced with Pulumi, and not everyone in your Azure Active Directory.
Under the **Settings** expansion panel, the **Scope** drop-down should be set to **Sync only assigned users and groups**. This ensures that only the users who are assigned to this application are synced with Pulumi, and not everyone in your Entra ID account.

![settings scope](/images/docs/reference/service/scim/azuread/settings_scope.png)

Set the **Provisioning Status** to **On** and then click **Save**.

## Assign Users and/or Groups

You must assign users to the Azure AD enterprise application to have them provisioned with an account in Pulumi. Click on the **Users and groups** feature in the left nav, and assign users and/or groups to the application by searching for them.
You must assign users to the Entra ID enterprise application to have them provisioned with an account in Pulumi. Click on the **Users and groups** feature in the left nav, and assign users and/or groups to the application by searching for them.

{{% notes "info" %}}
If you did not enable group provisioning while you were editing the provisioning setup, click on **Edit Provisioning** and enable the **Provision Azure Active Directory Groups** setting as well under the **Mappings** expansion panel.
If you did not enable group provisioning while you were editing the provisioning setup, click on **Edit Provisioning** and enable the **Provision Microsoft Entra ID Groups** setting as well under the **Mappings** expansion panel.
{{% /notes %}}

Review the **Provisioning logs** to ensure there were no errors while provisioning the users. It may take a few minutes for logs to appear. If there were validation errors, you can correct them and try again, or contact Pulumi for support.
Expand Down
2 changes: 1 addition & 1 deletion content/docs/pulumi-cloud/admin/organizations.md
Original file line number Diff line number Diff line change
Expand Up @@ -162,7 +162,7 @@ members that they can add or invite to the Pulumi organization.
Pulumi Enterprise and Business Critical provide support for any SAML 2.0-based identity provider.

* [SAML-based configuration guide](/docs/pulumi-cloud/access-management/saml/)
* [Azure Active Directory](/docs/pulumi-cloud/access-management/saml/aad/)
* [Microsoft Entra ID](/docs/pulumi-cloud/access-management/saml/entra/)
* [Google Workspace](/docs/pulumi-cloud/access-management/saml/gsuite/)
* [Auth0](/docs/pulumi-cloud/access-management/saml/auth0/)
* [Okta](/docs/pulumi-cloud/access-management/saml/okta/)
Expand Down
2 changes: 1 addition & 1 deletion content/docs/pulumi-cloud/get-started/onboarding-guide.md
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ Start by creating [your organization here](https://app.pulumi.com/?create-organi

### Configuring Single Sign-On (SSO)

Many organizations prefer to use Single Sign-On (SSO) to leverage an identity provider such as Azure Active Directory, Google Workspace, Okta, or any other SAML 2.0 compliant provider. To learn about configuring SSO for your organization, [read Pulumi Cloud SAML(SSO)](https://www.pulumi.com/docs/pulumi-cloud/access-management/saml/). If you’d like to continue using email, GitHub, GitLab, or Atlassian identity, you can skip this step.
Many organizations prefer to use Single Sign-On (SSO) to leverage an identity provider such as Microsoft Entra ID, Google Workspace, Okta, or any other SAML 2.0 compliant provider. To learn about configuring SSO for your organization, [read Pulumi Cloud SAML(SSO)](https://www.pulumi.com/docs/pulumi-cloud/access-management/saml/). If you’d like to continue using email, GitHub, GitLab, or Atlassian identity, you can skip this step.

### Inviting your teammates

Expand Down
4 changes: 2 additions & 2 deletions content/pricing/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -490,9 +490,9 @@ comparison_table:
- content: _blank
- content: _blank
- content: Many
tooltip: Azure Active Directory, Google Workspace, Okta, OneLogin, and more
tooltip: Microsoft Entra ID, Google Workspace, Okta, OneLogin, and more
- content: Many
tooltip: Azure Active Directory, Google Workspace, Okta, OneLogin, and more
tooltip: Microsoft Entra ID, Google Workspace, Okta, OneLogin, and more
- title: SCIM integration
link: /docs/pulumi-cloud/access-management/scim/
items:
Expand Down
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file not shown.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified static/images/docs/reference/service/scim/azuread/mappings.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.

0 comments on commit 1de3ada

Please sign in to comment.