> For the complete documentation index, see [llms.txt](https://docs.guardware.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.guardware.com/documentation/protect/azure-configurations/configure-azure-provisioning-in-guardware.md).
# Configure Azure Provisioning in GuardWare
Azure Provisioning allows you to synchronise users and groups from Microsoft Entra ID with GuardWare. This lets you manage user and group assignments in Microsoft Entra ID and automatically provision them in GuardWare.
This guide explains how to configure Azure Provisioning, set up the required attribute mappings, assign users and groups, and start provisioning.
{% hint style="info" %}
**Before you begin:** Make sure you have administrator access to Microsoft Azure/Microsoft Entra ID.
{% endhint %}
{% hint style="warning" %}
The Microsoft Entra ID interface may change over time. The names or locations of some options may differ slightly from those shown in the steps and images.
{% endhint %}
## 1. Get the GuardWare provisioning details
Before configuring Azure, get the provisioning credentials from the GuardWare Management Console.
1. Log in to the **GuardWare Management Console**.
2. Navigate to **Integrations**.
3. Select **Azure Provisioning Authentication**.
4. Copy the following values:
* **Azure Provisioning Token**
* **Azure Provisioning API Endpoint**
You will need these values when configuring the provisioning connection in Microsoft Entra ID.
> **Important:** Keep the **Azure Provisioning Token** secure. Do not share it with unauthorised users.
## 2. Create the GuardWare enterprise application
1. Log in to the **Azure Portal**.
2. Navigate to **Enterprise applications**.
3. Click **+ New application**.
4. Click **Create your own application**.
5. Enter a name for the application, such as **GuardWare**.
6. Select **Integrate any other application you don't find in the gallery (Non-gallery)**.\
7. Click **Create.**
After creating the application:
8. In Overview, click **Connect your application**.
9. Under **Select authentication method**, select **Bearer authentication**.
10. In **Tenant URL**, enter the **Azure Provisioning API Endpoint** copied from the GuardWare Management Console.
11. In **Secret token**, enter the **Azure Provisioning Token** copied from the GuardWare Management Console.
12. Click **Test connection**.
13. After the connection is successfully tested, click **Create**.
## 3. Configure attribute mappings
Attribute mappings define how information from Microsoft Entra ID is sent to GuardWare.
After creating the provisioning configuration:
1. Under **Manage**, select **Attribute mapping**.
First, add the GuardWare-specific group attribute to the provisioning schema.
2. In **Attribute mapping**, select the **Groups** tab.
3. Click **Advanced options**.
4. Select **Edit customappsso group attributes**.
5. Click **+ Add new attribute**.
6. In **Name**, enter:
```
urn:ietf:params:scim:schemas:extension:guardware:2.0:Group
```
7. Set **Type** to **String**.
8. Leave the other options at their default values.
9. Click **Save**.
10. Return to **Attribute mapping**.
11. Select **Groups**.
12. Click **Add attribute mapping**.
13. For **Mapping type**, select **Direct**.
14. For **Source attribute (Microsoft Entra ID)**, select **mail**.
15. For **Target attribute (customappsso)**, select:
```
urn:ietf:params:scim:schemas:extension:guardware:2.0:Group
```
16. Leave **Apply this mapping** set to **Always**.
17. Click **Add**.
The resulting group mappings should include the GuardWare-specific attribute:
| Microsoft Entra ID attribute | GuardWare attribute |
| ---------------------------- | ------------------------------------------------------------ |
| `displayName` | `displayName` |
| `members` | `members` |
| `objectId` | `externalId` |
| `mail` | `urn:ietf:params:scim:schemas:extension:guardware:2.0:Group` |
Next, update the user mapping so that GuardWare uses the user's original Microsoft Entra user principal name as the username.
18. Select the **Users** tab.
19. Locate the existing **userName** mapping and edit the existing `userName` mapping.
20. For **Mapping type**, select **Direct**.
21. For **Source attribute (Microsoft Entra ID)**, select **originalUserPrincipalName**.
22. For **Target attribute (customappsso)**, select **userName**.
23. Under **Match objects using this attribute**, select **Yes** and set **Matching precedence** to **1**.
24. Click **Apply** and **Save**.
Next, configure which actions Microsoft Entra ID can perform in GuardWare.
25. Under **Manage**, select **Provisioning**.
26. Expand **Mappings** and select **Provision Microsoft Entra ID Groups**.
27. Under **Target Object Actions**, enable **Create** and disable **Update** and **Delete**.
28. Click **Save**.
29. Return to **Mappings**.
30. Select **Provision Microsoft Entra ID Users**.
31. Under **Target Object Actions**, enable **Create** and disable **Update** and **Delete**.
32. Click **Save**.
## 4. Assign users and groups and start provisioning
You must assign the users or groups that you want to provision to GuardWare.
1. Under **Manage**, select **Users and groups**.
2. Click **+ Add user/group**.
3. Under **Users and groups**, click **None Selected**.
4. Search for and select the users or groups that should be provisioned. The group **GuardWare Protect All User** should be selected mandatorily. \
\
If the required GuardWare group does not exist, create the group from **Groups > New group**.
In **Group type**, select **Microsoft 365,** and in **Group name,** enter **Guardware Protect All Users,** leave the remaining group details as they are.
5. Click **Assign**.\
After completing the configuration and assigning the required users or groups:
6. Navigate to **Overview**.
7. Click **Start provisioning**.\
Azure will begin provisioning the assigned users and groups to GuardWare.
## 5. Generate the GuardWare Proxy Key
After provisioning has completed, generate the Proxy Key in the GuardWare Management Console.
1. Log in to the **GuardWare Management Console**.
2. Navigate to **Security Groups**.
3. If a Proxy Key does not already exist, click the notification at the top of the page.
4. In **Actions**, click **Create Key**.
The Proxy Key is now generated for the GuardWare security groups.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.guardware.com/documentation/protect/azure-configurations/configure-azure-provisioning-in-guardware.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
