You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: servicecontrol/security/entra-id-authentication.md
+75-38Lines changed: 75 additions & 38 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,102 +7,139 @@ component: ServiceControl
7
7
8
8
This guide explains how to configure Microsoft Entra ID (formerly Azure Active Directory) and ServiceControl to enable authentication for ServicePulse.
9
9
10
+
## Prerequisites
11
+
12
+
- Administrator permissions on the Microsoft Entra ID tenant
13
+
- ServiceControl 6.9.0 or later
14
+
- ServicePulse 2.5.0 or later
15
+
10
16
## Configure Microsoft Entra ID
11
17
12
18
Register ServiceControl and ServicePulse as applications in Microsoft Entra ID to allow users to authenticate.
13
19
14
20
### Create the ServiceControl app registration
15
21
22
+
This app registration represents the ServiceControl API and defines the permissions that ServicePulse will request when users sign in.
23
+
16
24
1. Navigate to the [Azure Portal](https://portal.azure.com/).
17
25
2. Open **Microsoft Entra ID** and select **Manage** > **App registrations**.
18
26
3. Click **+ New registration**.
19
27
4. Configure the registration:
20
28
-**Name**: `ServiceControl API`
21
-
-**Supported account types**: Accounts in this organizational directory only
29
+
-**Supported account types**: Accounts in this organizational directory only (single tenant)
22
30
- Click **Register**.
23
-
5. On the **Overview** page, click **Endpoints** and copy the **OpenID Connect metadata document** URL (remove `/.well-known/openid-configuration` from the end). This is the authority URL used for `ServiceControl/Authentication.Authority`.
31
+
32
+
> [!NOTE]
33
+
> Select **Accounts in any organizational directory** (multi-tenant) if users from multiple Entra ID tenants need access to ServicePulse.
34
+
35
+
5. On the **Overview** page, copy the **Directory (tenant) ID**. This is used to construct the authority URLs.
24
36
6. Select **Manage** > **Expose an API**.
25
-
7. Next to **Application ID URI**, click **Add** and save the default value.
26
-
8. Under **Scopes defined by this API**, click **Add a scope** and configure:
37
+
7. Next to **Application ID URI**, click **Add** and save the default value (e.g., `api://{application-id}`).
38
+
8. Copy the **Application ID URI**. This is used for `ServiceControl/Authentication.Audience`.
39
+
9. Under **Scopes defined by this API**, click **Add a scope** and configure:
27
40
-**Scope name**: `api.access`
28
41
-**Who can consent?**: Admins and users
29
42
-**Admin consent display name**: `Full access to ServiceControl API`
30
43
-**Admin consent description**: `Allows ServicePulse to call ServiceControl`
31
44
-**State**: Enabled
32
45
- Click **Add scope**.
33
-
9. Copy the **Application ID URI**. This is used for `ServiceControl/Authentication.Audience` and as part of `ServiceControl/Authentication.ServicePulse.ApiScopes`.
34
46
35
47
### Create the ServicePulse app registration
36
48
49
+
This app registration represents ServicePulse as a client application that users will sign into.
50
+
37
51
1. In **App registrations**, click **+ New registration**.
38
52
2. Configure the registration:
39
53
-**Name**: `ServicePulse`
40
-
-**Supported account types**: Accounts in this organizational directory only
54
+
-**Supported account types**: Accounts in this organizational directory only (single tenant)
41
55
-**Redirect URI**:
42
56
-**Platform**: Single-page application (SPA)
43
-
-**URI**: `http://localhost:5291/`
57
+
-**URI**: The URL where ServicePulse is hosted (e.g., `https://servicepulse.example.com/`)
44
58
- Click **Register**.
59
+
60
+
> [!WARNING]
61
+
> Redirect URIs must use HTTPS in production environments. HTTP is only acceptable for local development (e.g., `http://localhost:9090/`).
62
+
45
63
3. Copy the **Application (client) ID**. This is used for `ServiceControl/Authentication.ServicePulse.ClientId`.
46
64
4. Select **Manage** > **API permissions**.
47
65
5. Click **+ Add a permission**.
48
66
6. Select the **APIs my organization uses** tab.
49
-
7.Search for and select**ServiceControl API**.
50
-
8. Under **Delegated permissions**, enable**api.access**.
67
+
7.Select**ServiceControl API**.
68
+
8. Under **Delegated permissions**, check**api.access**.
51
69
9. Click **Add permissions**.
52
70
71
+
> [!NOTE]
72
+
> If ServicePulse is accessed from multiple URLs (e.g., localhost during development and a production URL), add each URL as a redirect URI in the ServicePulse app registration under **Manage** > **Authentication**.
73
+
53
74
## Configure ServiceControl
54
75
55
-
Add the Entra ID application details to the ServiceControl configuration to enable authentication.
76
+
Add the Entra ID application details to the ServiceControl Error instance configuration to enable authentication. The same settings apply to Audit and Monitoring instances, using their respective prefixes.
77
+
78
+
### Collected values
79
+
80
+
During the Entra ID configuration, the following values should have been collected:
81
+
82
+
| Value | Source | Used for |
83
+
|-------|--------|----------|
84
+
| Directory (tenant) ID | ServiceControl API app registration > Overview | Authority URLs |
85
+
| Application ID URI | ServiceControl API app registration > Expose an API |`Authentication.Audience` and `Authentication.ServicePulse.ApiScopes`|
Environment variables can be used instead of App.config, which is useful for containerized deployments and local development. Convert setting names by replacing `/` and `.` with `_`.
Environment variables take precedence over App.config settings.
111
+
Environment variables can be used instead of App.config, which is useful for containerized deployments. Environment variables take precedence over App.config settings.
To enable authentication on Audit and Monitoring instances, configure the same settings using their respective prefixes. Only the base authentication settings are required; the ServicePulse settings are only needed on the Error instance.
0 commit comments