• Cloud Edge Secure Access
• Welcome to SonicWall Cloud Edge!
• Prerequisites
• Installation
  • Accessing the Client Management Console
  • Installation Methods
• Networks
  • Understanding Networks
  • SDP Networks
  • Regions and Gateways
    • Adding a region
    • Adding a gateway
  • Connecting Infrastructure
    • Prerequisites
    • Site-to-Site Connections
    • IPsec Tunnel
    • WireGuard Connector
    • Connect On-Prem Resources
      • Firewalls
        • SonicWall
    • Connect Cloud Resources
      • Amazon AWS
        • AWS Virtual Gateway
        • AWS Transit Gateway
      • Alibaba Cloud
      • Microsoft Azure
      • Google Cloud Platform
      • Heroku Enterprise
      • IBM Cloud
      • Docker
• Groups and Members
  • Members
    • Inviting Members
    • Password Requirements
    • Managing Roles
  • Groups
    • Managing Groups
    • Identity Provider Groups
  • Identity Providers (IdP)
    • Integrate Identity Providers
    • Azure AD
      • Azure Active Directory (SAML 2.0)
      • Azure Active Directory
    • Google Suite
      • Google Services
      • Google Apps (SAML 2.0)
    • On-Premises Active Directory
    • SAML 2.0
      • Generic SAML
      • Active Directory Federation Services (ADFS)
      • Auth0
      • Okta
      • OneLogin
      • PingIdentity
      • JumpCloud
• Securing the Platform
  • Securing Networks
    • Segmenting Networks
    • Device Posture Check
    • Network Traffic Control
    • Firewall-as-a-Service
  • Securing User Access
    • Multi-Factor Authentication
      • MFA Authentication
      • DUO Security
    • Agent-less Access
      • Zero Trust Application
        • HTTP/HTTPS
        • RDP (Remote Desktop Protocol)
        • SSH (Secure Shell)
        • VNC (Virtual Network Computing)
      • Zero Trust Policies and Rules
    • Agent-based Access
      • SonicWall Agents
        • Downloading and Installation
      • Agents Configuration
        • User-Groups Policies
        • Managing Configurations
        • General Configurations
        • Network Configuration
        • OS-Specific Configurations
• Monitoring
  • Activity Tracking
    • Activities and Logs
    • Member Devices
  • Monitoring Dashboard
  • Integrations
    • Amazon S3
    • Azure Sentinel
    • Splunk Cloud
• Compliance
  • HIPAA
  • GDPR
  • SOC 2 Type 2
• SonicWall Support
  • About This Document

Azure Active Directory

This article describes how to allow users to log in using a Microsoft Azure Active Directory account, either from your company or from external directories. You must register your application through the Microsoft Azure portal. If you don't have a Microsoft Azure account, you can sign up for free.

• Creating a new application
• Configuring the permissions
• Allowing access from external organizations (optional)
• Configuring the key
• Configuring Reply URLs
• Configuring IDP connection

You can access the Azure management portal from your Microsoft service, or visit https://portal.azure.com/ and sign in to Azure using the global administrator account used to create the Office 365 organization.

If you have an Office 365 account, you can use the account's Azure AD instance instead of creating a new one. To find your Office 365 account's Azure AD instance:

1. Sign in to Office 365.
2. Navigate to the Office 365 Admin Center.
3. Open the Admin centers menu options located on the left menu.

4. Select Azure AD. This will take you to the Admin Center of the Azure AD instance backing your Office 365 account. Follow the steps below to connect your SonicWall Cloud Edge Account to Azure Active Directory (images below):

5. Create a new application.
6. Configure the permissions.
7. Allow access from external organizations (optional).
8. Create the key.
9. Configure Reply URLs.
10. Configure SonicWall Cloud Edge IDP connection.

Creating a new application

1. Log in to Microsoft Azure and choose Azure Active Directory from the sidebar.

   

   

2. Under Manage, select App registrations.

   

3. Select NewRegistration to add a new application.

   

4. Enter the name "SonicWall Cloud Edge" for the application, select Web app/API as the Application Type, and for Sign-on URL enter your application URL with your workspace name: [https://workspace.sonicwalledge.com].

   

Configuring the permissions

1. Once the application has been created, you will have to configure the permissions. Select the name of the application SonicWall Cloud Edge to open the Settings section.

   

2. Select API permissions.

   

3. Select Add a permission.

   

4. Select APIs my organization uses and choose Windows Azure Active Directory to change the access level.

   

   The following page displays:

   

5. The next step is to modify permissions so your app can read the directory. Under Delegated<![CDATA[ ]]>permissions, check next to Sign in and read user profile and Read directory data.

   

6. Grant Admin Consent if requested.

Support user groups

1. If you want to enable user group support you will need to enable the following permissions:

   • Application Permissions: Read directory data
   • Delegated Permissions: Access the directory as the signed-in user.
2. Select Save at the top to save these changes.
3. Grant Admin Consent if requested.

Allowing access from external organizations (optional)

1. If you want to allow users from external organizations (such as other Azure directories) to log in, you will need to enable the Multi-Tenant option for this application. In the Authentication section, choose the Multi-tenant option.
2. Select Save at the top to save these changes.

3. Grant Admin Consent if requested.

   

Configuring the key

1. You will need to create a key (secret password) that will be used as the Client Secret in the SonicWall Cloud Edge IDP connection. Select Certificates and secrets from the Application menu.

   

2. Enter a name for the key and choose the desired duration.

   If you choose an expiring key, make sure to record the expiration date in your calendar, as you will need to renew the key (get a new one) before that day to ensure users don't experience a service interruption.

   Select Add and the key will be displayed. Make sure to copy the value of this key before leaving this screen, otherwise, you may need to create a new key. This value is used as the Client Secret in the next step.

   

   

Configuring Reply URLs

1. Next, you need to ensure that your Auth0 callback URL is listed in allowed reply URLs for the created application.

2. Navigate to Azure Active Directory, then Apps registrations and select the SonicWall Cloud Edge app. Then select Authentication, go to Redirect URLs and add the following link:
   https://auth.sonicwalledge.com/login/callback

   

3. Select Save.

Configuring IDP connection

1. Log in to your SonicWall Cloud Edge Management Platform, navigate to Settings, and then Identity Providers.

   

2. Select + Add Provider.

3. Choose Microsoft Azure AD.

   

4. Fill in Microsoft Azure AD Domain (your domain - for example sonicwall.com), Domain Aliases (optional), Client ID, and Client Secret. For the Client ID, this value is stored as the Application ID in Azure AD.

   

5. For the Client Secret use the value that was shown for the key when you created it in the previous step.
6. Under Domain set the name of the Microsoft Azure AD Domain and under Domain Aliases insert any email domain that corresponds to the connection.

7. Select Done.

   If your users are getting access errors after the configuration, please check these steps.