Automatic Federation with customer’s Azure AD
Prerequisites
- You wish to use the B2B cross tenant federation automatically provided by Microsoft Azure AD
- This article only applies if your Evolphin Zoom MAM is hosted in Evolphin managed cloud instance.
- Your organization uses an Azure AD tenant to manage their user credentials (password, MFA) for your primary domain. For example.if your primary domain is: mycompany.com and your users’ User principal name (UPN) is in the format: user@mycompany.com
- You would like Zoom MAM to automatically delegate authentication of user@mycompany.com to your Azure AD
- If you have external users whose UPN is not in your primary domain you can simply ask Evolphin managed service to add them as external guest users in Evolphin’s own Azure AD. For example, if a guest user’s UPN is external@guest.com instead of external@mycompany.com.
How does automatic federation work with your Azure AD?
Surprisingly this flow (Azure AD B2B federation) is not well understood by even experience Azure AD administrators. Here it goes:
- Evolphin Zoom MAM uses by default its own Azure AD to manage users who need access to the customer’s cloud instance.
- In other words when you purchase a subscription to Evolphin Zoom MAM cloud instance, it comes pre-configured with Evolphin’s Azure AD tenant.
- Many SMB customers do not have the skills to manage their own Azure AD or an external IdP. These customers are happy to delegate the user management into Evolphin’s integrated Azure AD.
- Evolphin simply invites the customer’s users as external or guest user from its own Azure AD. The invited external users can then create an account in Evolphin’s Azure AD and setup their credentials & MFA to authenticate into their Zoom MAM in the cloud.
- However for many enterprise customers that already have an Azure AD instance for managing users in their primary domain, there is no need to delegate credentials management to Evolphin Zoom’s Azure AD.
- For such customers, the only thing that happens in Zoom MAM is user provisioning. Once the customer gets the users invited as external users from Evolphin Zoom’s Azure AD, when they try to sign-in Microsoft Azure AD notices that their primary domain are already hosted in customer’s own Azure AD tenant.
- At that point, customer’s Azure AD obtains the consent of the invited users to allow it to be used as the authentication service.
- The net result is the enterprise user performs their authentication with their own Azure AD and
- Evolphin Zoom’s Azure AD simply delegates the authentication to customer’s Azure AD
- Once the authentication succeeds at the customer’s Azure AD, a secure authentication token/assertion is exchange via OpenID Connect protocol to validate to the Zoom MAM server that the authenticated user is provisioned as a valid user in the Zoom Cloud MAM
- Based on the roles setup in the Zoom MAM, the authentication user is then granted access to the specific resources they are entitled to.
In summary, the Evolphin Azure AD to customer Azure AD federation happens in the background using a built-in cross tenant B2B federation model that Azure AD has always supported. It requires no configuration on part of the customer Azure AD administrator. It could not be simpler! Security is never compromised as the Zoom user has to consent to letting their Azure AD be in charge of authenticating the user.
Check this article on how this looks from the end user’s perspective.
What if my external user's UPN is not in my primary domain?
If the customer works with freelancers or external collaborators chances are their email address does not belong to your company’s primary domain.
Let’s review this by way of the following scenarios:
Guest user with Google email address
Suppose the guest user’s UPN is external@gmail.com instead of external@mycompany.com. Since Evolphin Zoom’s Azure AD is configured with Google as an external identity provider, Zoom MAM will automatically delegate authentication to Google. Nothing needs to be configured.
Guest user with their own email domain
What if your guest user’s email address is on a completely different custom domain such as external@guest.com instead of external@mycompany.com or external@gmail.com?
You have two options ranging from simplest to more complex:
- Option 1: Evolphin can manage the freelancer as an external guest user in its own Azure AD. The initial guest invite will need to be send from Evolphin Zoom MAM as part of the guest user provisioning. Such a user can then create an account with their password in the Evolphin Zoom Azure AD. There is no configuration needed here.
- Option 2: You wish to manage even the guest users within your own Azure AD. In other words, you do not wish to let Evolphin Azure AD invite the guest user. In this case you will need to configure your Azure AD to connect with Evolphin Zoom MAM server directly. See this article for the steps involved.
- Last modified on