Configure Azure Provisioning in GuardWare

Azure Provisioning allows you to synchronise users and groups from Microsoft Azure/Microsoft Entra ID with GuardWare. This lets you manage user and group assignments in Microsoft Entra ID and automatically provision them to GuardWare.

This guide explains how to configure Azure Provisioning, set up the required attribute mappings, assign users and groups, and start provisioning.

Before you begin: Make sure you have administrator access to Microsoft Azure/Microsoft Entra ID.

The Microsoft Entra ID interface may change over time. The names or locations of some options may differ slightly from those shown in the steps and images.

1. Get the GuardWare provisioning details

Before configuring Azure, get the provisioning credentials from the GuardWare Management Console.

1. Log in to the GuardWare Management Console.
2. Navigate to Integrations.
3. Select Azure Provisioning Authentication.

   
4. Copy the following values:

   • Azure Provisioning Token
   • Azure Provisioning API Endpoint

   You will need these values when configuring the provisioning connection in Microsoft Entra ID.

Important: Keep the Azure Provisioning Token secure. Do not share it with unauthorised users.

2. Create the GuardWare enterprise application

1. Log in to the Azure Portal.
2. Navigate to Enterprise applications.
3. Click + New application.

   
4. Click Create your own application.

   
5. Enter a name for the application, such as GuardWare.
6. Select Integrate any other application you don't find in the gallery (Non-gallery).
7. Click Create.

After creating the application:

1. In Overview, click Connect your application.

   
2. Under Select authentication method, select Bearer authentication.
3. In Tenant URL, enter the Azure Provisioning API Endpoint copied from the GuardWare Management Console.
4. In Secret token, enter the Azure Provisioning Token copied from the GuardWare Management Console.
5. Click Test connection.

   
6. After the connection is successfully tested, click Create.

   

3. Configure attribute mappings

Attribute mappings define how information from Microsoft Entra ID is sent to GuardWare.

After creating the provisioning configuration:

1. Under Manage, select Attribute mappings.

First, add the GuardWare-specific group attribute to the provisioning schema.

1. In Attribute mappings, select the Groups tab.
2. Click Advanced options.
3. Select Edit customappsso group attributes.

   
4. Click + Add new attribute.

   
5. In Name, enter:

urn:ietf:params:scim:schemas:extension:guardware:2.0:Group

1. Set Type to String.

1. Leave the other options at their default values.
2. Click Save.
3. Return to Attribute mappings.
4. Select Groups.
5. Click Add attribute mapping.

   
6. For Mapping type, select Direct.
7. For Source attribute (Microsoft Entra ID), select mail.
8. For Target attribute (customappsso), select:

urn:ietf:params:scim:schemas:extension:guardware:2.0:Group

1. Leave Apply this mapping set to Always.

1. Click Add.

The resulting group mappings should include the GuardWare-specific attribute:

Microsoft Entra ID attribute	GuardWare attribute
displayName	displayName
members	members
objectId	externalId
mail	urn:ietf:params:scim:schemas:extension:guardware:2.0:Group

Next, update the user mapping so that GuardWare uses the user's original Microsoft Entra user principal name as the username.

1. Select the Users tab.
2. Locate the existing userName mapping and edit the userName mapping.

1. For Mapping type, select Direct.
2. For Source attribute (Microsoft Entra ID), select originalUserPrincipalName.
3. For Target attribute (customappsso), select userName.

   
4. Under Match objects using this attribute, select Yes and set Matching precedence to 1.
5. Click Apply and Save.

Next, configure which actions Microsoft Entra ID can perform in GuardWare.

1. Under Manage, select Provisioning.
2. Expand Mappings and select Provision Microsoft Entra ID Groups.

1. Under Target Object Actions, enable Create and disable Update and Delete.

1. Click Save.
2. Return to Mappings.
3. Select Provision Microsoft Entra ID Users.
4. Under Target Object Actions, enable Create and disable Update and Delete.

   
5. Click Save.

4. Assign users and groups and start provisioning

You must assign the users or groups that you want to provision to GuardWare.

1. Under Manage, select Users and groups.
2. Click + Add user/group.

   
3. Under Users and groups, click None Selected.
4. Search for and select the users or groups that should be provisioned. The group GuardWare Protect All User must be selected.

   If the required GuardWare group does not exist, create the group from Groups > New group.

   In Group type, select Microsoft 365, and in Group name, enter GuardWare Protect All Users, and leave the remaining group details as they are.

   
5. Click Assign.

After completing the configuration and assigning the required users or groups:

1. Navigate to Overview.
2. Click Start provisioning.

   

Azure will begin provisioning the assigned users and groups to GuardWare.

5. Generate the GuardWare Proxy Key

After provisioning is complete, generate the Proxy Key in the GuardWare Management Console.

1. Log in to the GuardWare Management Console.
2. Navigate to Security Groups.
3. If a Proxy Key does not already exist, click the notification at the top of the page.

   
4. In Actions, click Create Key.

The Proxy Key is now generated for the GuardWare security groups.