Azure Active Directory Single Sign-on (SSO) For Vonage .

Azure Active DirectorySingle Sign-on (SSO) forVonage Business Communications1

AZURE ACTIVE DIRECTORY SINGLE SIGN-ON (SSO) FOR VBCIntroduction2What is Azure Active Directory?2Prerequisites2Configuring Azure Active Directory Single Sign-on3Add a non-gallery application3Configure user sign-in properties3Configure SAML-based single sign-on4Step 1. Set up Vonage Business Communications to use Azure AD4Step 2. Edit the Azure AD SAML Configuration5Step 3. Configure User attributes6Step 4. Add user assignments7Step 5. Finished8IntroductionThis document describes how to configure Single Sign-on for Vonage Business Communications using Azure ActiveDirectory as your identity provider (IDP).What is Azure Active Directory?Azure Active Directory (Azure AD) is Microsoft's cloud-based identity and access management service, whichhelps your employees sign in and access resources. Azure Active Directory enables single sign-on access to cloudapplications (like Vonage Business Communications).Once a user signs into Azure Active Directory, they can then launch any of their enabled web apps without reentering their login credentials for each app. Azure Active Directory establishes a secure connection with the user’sbrowser. It then authenticates the user to login to Azure Active Directory managed apps via SAML, a pre-integrated,federated authentication protocol.For more information, see Single Sign-on SAML protocol.Prerequisites A Microsoft Azure account is required to configure Single Sign-on using Azure AD. Usernames are required to match the NameID of the corresponding user account in Azure AD, which is typicallythe email address of the user. If your Vonage Business Communications usernames are not email addresses it isrecommended that they are updated prior to setup to avoid errors.2

AZURE ACTIVE DIRECTORY SINGLE SIGN-ON (SSO) FOR VBCConfiguring Azure Active Directory Single Sign-onAdd a non-gallery application1.Sign in to the Azure Active Directory portal using your Microsoft identity platform administrator account.2.Select Enterprise Applications New application.3.Search for Vonage from the box labeled Search application.4.From the search results, click on the Vonage application.5.You can now rename the application if desired and then click the Create button.The Application Overview page will now open.3

AZURE ACTIVE DIRECTORY SINGLE SIGN-ON (SSO) FOR VBCConfigure SAML-based single sign-onStep 1. Set up Vonage Business Communications to useAzure ADThe Set up applicationName section lists the values that need to be configured so that Vonage Business Cloudwill use Azure AD as a SAML identity provider.1.From the Application Overview page, click the Set up single sign on tile.2.Select SAML. The Setup Single Sign-On with SAML page appears.3.Scroll down to the SAML Signing Certificate section.4.Click on the Download link next to the Certificate (Base64) option.5.Save the certificate for when you set up Vonage to use Azure AD.6.Scroll down to the Set up applicationName section.7.Open the Vonage Business Communications Single Sign-on Settings page in a separate browser window.8.Copy the values from Azure AD into your Vonage Business Communications Single Sign-on Settings.4

AZURE ACTIVE DIRECTORY SINGLE SIGN-ON (SSO) FOR VBCAzure AD SettingVBC SettingLogin URLSign-in page URLAzure AD IdentifierEntity IDLogout URLSign-out page URL9.Upload your X509 certificate into the Upload Certificate field.10.When you've pasted all the values into the appropriate fields, select Save.Step 2. Edit the Azure AD SAML Configuration1.To edit the basic SAML configuration options, select the Edit icon (a pencil) in the upper-right corner of theBasic SAML Configuration section at the top of the page.2.Copy the values from your Vonage Business Communications Service Provider Settings on the VonageBusiness Communications Single Sign-on Settings page into your enterprise application.Azure AD SettingVBC SettingReply URL (Default)Sign-in URL (Default)Azure AD IdentifierSign-in URL (Secondary)Identifier (Entity ID)replace existing valueEntity IDLogout URLSign-out URL3.Update the following settingsAzure AD SettingValueRelay State04.Click Save to save your changes.5.Now that you have updated the credentials, your Azure certificate may have changed. Please follow theprocess above to re-download the certificate from Azure and upload to your VBC account.5

AZURE ACTIVE DIRECTORY SINGLE SIGN-ON (SSO) FOR VBCStep 3. Configure User attributes (optional)This step is only required for advanced configurations.When a user authenticates to the application, Azure AD issues the application a SAML token with information (orclaims) about the user that uniquely identifies them. By default, this information includes the user's username,email address, first name, and last name. You might need to customize these claims if, for example, the applicationrequires specific claim values or a Name format other than username.1.In the User Attributes and Claims section, select the Edit icon (a pencil) in the upper-right corner.2.Verify the Name Identifier Value. The default value is user.principalname. The user identifier uniquelyidentifies each user within the application. For example, if the email address is both the username and theunique identifier, set the value to user.mail.3.To modify the Name Identifier Value, select the Edit icon (a pencil) for the Name Identifier Value field.Make the appropriate changes to the identifier format and source, as needed.4.Select Save. The new claim appears in the table.6

AZURE ACTIVE DIRECTORY SINGLE SIGN-ON (SSO) FOR VBCStep 4. Add user assignmentsIf User assignment required was selected when creating your enterprise application, you will need to add users toyour application so they can sign in.1.In the left navigation menu, select Users and groups.2.Select the Add user button.3.On the Add Assignment pane, select Users and groups.4.Select the user or group you want to assign to the application or start typing the name of the user orgroup in the search box. You can choose multiple users and groups, and your selections will appearunder Selected items.5.When finished, click Select.6.On the Users and groups pane, select one or more users or groups from the list and then choosethe Select button at the bottom of the pane.7

Step 5. FinishedNow that you have configured Vonage Business Communications to use Azure AD, your end users are ready to useSingle Sign-on.You can start using Single Sign-on from any Vonage Business Communications login page. Get started by clickingLogin with Single Sign-on on the login form.For more information, contact support@vonage.com 8

For more information, see Single Sign-on SAML protocol. Prerequisites A Microsoft Azure account is required to configure Single Sign-on using Azure AD. Usernames are required to match the NameID of the corresponding user account in Azure AD, which is typically the email address of the user.