Security
      Back to home
      1. Help Center
      2. Cloud
      3. Security

      How to enable Sign in with Microsoft

      This article describes the steps required to enable authentication to ActiveNav Cloud with your enterprise Microsoft Entra ID tenant.

      Are you seeing this?

      NotFederatedSignin-1

      If a user clicks the "Sign in with Microsoft" button when the organization has not configured federated sign in with ActiveNav Cloud, the screen above will be presented.

      If your organization wants to use your Microsoft Entra ID for authentication to ActiveNav Cloud, the instructions below will provide background information about how federated sign in works and how to configure with ActiveNav Support.

      Introduction

      ActiveNav Cloud allows for two authentication methods: email address and Microsoft Entra ID Federated Sign In. When your ActiveNav Cloud tenant was created, the first user was configured to use an email address. If you wish to allow users to authenticate with their Microsoft Entra ID account, the first step is to contact support@activenav.com and supply your Microsoft Entra ID tenant identifier.

      AzAD Tenant ID

      An ActiveNav Support Engineer will link your Microsoft Entra ID to your ActiveNav Cloud tenant.

      Granting Permissions to ActiveNav Cloud

      The ActiveNav Cloud application requires the following basic Microsoft Graph API permissions to allow Microsoft Entra ID authentication:

      • profile - Allows the app to see your users' basic profile (e.g., name, picture, username, email address).
      • offline_access - Allows the app to see and update the data you gave it access to, even when users are not currently using the app. This does not give the app any additional permissions.
      • User.Read - Allows users to sign-in to the app and allows the app to read the profile of signed-in users. It also allows the app to read basic company information of signed-in users.
      • openid - Allows users to sign into the app with their work or school accounts and allows the app to see basic user profile information.
      • email - Allows the app to read your users' primary email address.

      These permissions may be granted by the user or by an administrator on behalf of the organization to all users.

      NOTE: Granting ActiveNav Cloud access to all users does not grant access to ActiveNav for all users. User access is controlled by ActiveNav Cloud Roles. (See Application User Roles below, User Roles, and Managing Users.)

      There are three methods supported for granting the permissions required for Microsoft Entra ID sign in:

      1. For the whole organization
      2. As an individual user

      3. As an administrator, for all users

      Please contact support@activenav.com for more details.

      Method 1 - For the whole organization

      The most convenient way to grant these permissions is to have a Microsoft Entra administrator use the link for your Cloud instance to add the ActiveNav Cloud App as an Enterprise application. The region of your instance will can be determined from the first part of the ActiveNav Cloud URL.

      The administrator will be asked to sign in with an account:

      AzADSignOnChooseAdminAccount

      Once the administrator is authenticated, Microsoft Entra ID will present a screen to accept the permissions requested by ActiveNav Cloud for the entire organization.

      AzAD Sign On Permission Page - Organization

      Normally, the Entra ID application registration process will lead to a splash screen confirming the activity in the form shown below.

      You can validate that the ActiveNav app has been registered by looking in your Entra ID Enterprise Applications for ActiveNav Cloud.

      Az Enterprise Applications ActiveNav Cloud

      Once the application has been granted permissions, your users can follow the instructions describe in First Time Login below.

      Method 2 - As an individual user

      Without adding the application to your Microsoft Entra ID, the default behavior for permissions is that they are granted by the user. When the user selects the "Sign in with Microsoft" option, they will be presented with a permissions screen.

      AzAD Sign On Permission Page - User

      Once the application has been granted permissions, your user can follow the instructions describe in First Time Login below.

      Method 3 - As an administrator, for all users

      Another method of granting permissions for all users is to have a Microsoft Entra administrator use the "Sign in with Microsoft" button. The permissions request screen will include an option to "Consent on behalf of your organization". Choosing this option will remove the permission screen from any new users signing in with Microsoft. (This is equivalent to Method 1 but adds the administrator as an ActiveNav Cloud user.)

      AzAD Sign On Permission Page - Admin

      Once the application has been granted permissions, your user can follow the instructions describe in First Time Login below.

      First Time Login

      image-png

      The first time a user authenticates with this method, their browser will present a dialog for identity selection.

      AzADSignOnChooseAccount-1

      ActiveNav Cloud will connect to the federated Entra ID directory, and auto-populate the user name for the new account. The user can edit these values.

      AzADSignOnCreateAccount

      When the user clicks the Create button, the user account will be created in ActiveNav Cloud. The application will show a message confirming the creation of the account, but that there are no roles assigned.

      AzADSignOnCreateAccountSuccess

      An email message is sent to all users assigned to the ActiveNav Cloud Administrator role. An Administrator can add Roles to the user's account from the System > Users page.

      Edit User No RolesOnce the user has assigned Roles, they can sign in to ActiveNav Cloud with their Microsoft Entra ID and access the application.