Sapling - Microsoft Azure AD Integration Guide

Introduction 

Azure Active Directory (Azure AD) is Microsoft’s cloud-based identity and access management service, which helps employees to sign in and access both internal and external resources.

With Kallidus Sapling’s integration with Azure AD, you can:

• Automatically provision new Azure AD accounts

• Keep profile information in Azure AD up to date by pushing specific profile fields from Sapling → Azure AD

• De-provision employee accounts in Azure AD when they are offboarded in Sapling

This guide provides a walkthrough on how Sapling Admins can enable the Azure AD integration.

Important notes:

1. This integration requires a small configuration on the backend by the Sapling team. Once you've completed the enablement steps below, please reach out our Support team so we can complete our internal setup. 
2. In order for Sapling to be able to create and make updates to profiles in Azure AD, the user who authorizes the integration must have the admin role of user administrator in Azure.
3. Currently Sapling does not support a Sapling <> Azure AD data sync for existing employee attributes. We can only sync data for new employees who have been onboarded via Sapling.
   • To work around this, setup a custom report on field changes that you care about being updated in Azure AD, and have IT check in on that report to confirm changes in Sapling took effect in Azure AD.

This article covers the following topics: 

• Add Azure AD To Sapling
• Testing
  • Provision Users within Azure AD using Sapling app
  • De-provision Users within Azure AD using Sapling
• What fields are updated from Sapling → Azure AD?

Setting up the integration

IMPORTANT: You'll need the User administrator role in Azure to correctly activate this integration. Be sure you have that role before starting.

First, login to your Sapling account. Navigate from Home > Integrations, and turn on the toggle for Azure AD.

In the Subdomain box, add your unique Azure AD domain (eg. yourcompany.com). To enable changes to be sent from Sapling to Azure, turn on the "sync changes" toggle.

Hit the “Next” button after you’ve entered the subdomain.

On the following screen, you'll need to authorize the integration by clicking "Connect". This will connect with Azure AD and walk you through the Microsoft consent screen with requested permissions (user provisioning).

Note: to authorize on this screen, you must login using an account with the Microsoft Azure User administrator role (e.g. IT manager).

After successful authorization, you should be redirected back to the Sapling website. Next, click "Activate" to complete the integration. 

Finally, please reach out to our Support team so we can complete our internal setup. 

Testing

Provision Users within Azure AD using Sapling app

Start onboarding a test user using the Sapling onboarding workflow.

1. This should send an email to the test user’s personal and company email account.
2. This also makes a call to Azure AD to provision a user account in AD.
3. Wait for ~1 min.

Next, login to the Azure AD portal and Click on “Users”.

Verify that a test user has been created.

De-provision Users within Azure AD using Sapling

First, login to Sapling. *note: you must be a Sapling Admin to make these updates.

With the same test-user as above, go to their profile page. From the “Actions” menu, select “Start Offboarding” and click through the Offboarding flow.

Once the test user is fully offboarded, return to your Azure AD profile. Go to the “Users” section and verify that the user has been de-provisioned.

A de-provision request is sent to Azure AD when:

• The team member has been offboarded and moved to the 'Departed' stage
• and the team member's state has been changed to "Inactive"

**Note: As long as you have deprovisioning rules set up in Azure AD to take effect to de-provision access based on the offboarding request, it can de-provision/suspend access to all software that's been provisioned via the Azure AD account.

What fields are updated from Sapling → Azure AD?

We send the following fields from Sapling to Azure:

1. First Name
2. Last Name
3. Email
4. Title
5. Location
6. Department
7. State
8. Mobile Phone