Skip to main content

Integrate Kisi with Azure Active Directory

info

This is a Kisi-built integration, maintained and supported by Kisi.

As a Kisi organization owner you can set up Azure single sign-on (SSO) for your Kisi users. To further control your SSO integration, you can sync it with your Azure Active Directory members and groups with SCIM.

Kisi organizations with single sign-on (SSO) can, if needed, also enable authentication with password for users. If enabled, the user will be able to log in with email and password. If the user is in the organizations' IdP directory, an SSO login will also be available.

Prerequisites​

  • a Kisi organization owner account
  • a valid and activated SSO license

Before setting up the integration, ensure you are logged in as the Kisi organization owner and have a valid, activated SSO license. If these prerequisites are met and the SSO & SCIM option is still not visible on the dashboard, please reach out to Kisi Support for assistance.

Enable SSO on Azure Active Directory​

Set up the integration in Azure Active Directory​

  1. Sign in to your Azure Active Directory portal
  2. Navigate to Enterprise Applications and select All Applications
  3. Click on New application
  4. Start typing Kisi Physical Security in the search field
  5. Select Kisi Physical Security from the list and click on Create.
  6. On the Kisi Physical Security application integration page navigate to the Manage section
  7. Click on Single sign-on
  8. When prompted to Select a single sign-on method, select SAML
  9. When prompted to Set up single sign-on with SAML, select Edit under the Basic SAML Configuration section
  10. Here, if you want to configure the application in IDP initiated mode, enter the following values for the following fields:
  • In the Identifier field, type the following URL: https://api.kisi.io/saml/metadata
  • In the Reply URL field, type the following URL: https://api.kisi.io/saml/consume/<DOMAIN> (You can find your Kisi organization domain under Organization Setup > Settings)
  1. If you want to configure the application in SP initiated mode, click Set additional URLs and in the Sign-on URL field type the following URL: https://web.kisi.io/organizations/sign_in?domain=<DOMAIN>
  2. Kisi expects the SAML assertions in a specific format, which requires you to add custom attribute mappings to your SAML token attributes configuration under User Attributes & Claims. Here is the list of default attributes:
User attributesClaims
givennameuser.givenname
surnameuser.surname
emailaddressuser.mail
nameuser.userprincipalname
Emailuser.userprincipalname
FirstNameuser.givenname
LastNameuser.surname
Unique User Identifieruser.userprincipalname
  1. Under SAML Signing Certificate, copy the App Federation Metadata URL and save it on your computer
tip

For more information, check out the Microsoft's tutorial on how to integrate Kisi with Azure Active Directory.

Set up the integration in Kisi​

  1. Sign in to Kisi as the organization owner
  2. Under Organization Setup, click on SSO & SCIM and paste the App Federation Metadata URL that you saved in the step above
  3. Click Save
note

You don't need any additional encryption certificate to set up SSO on Azure.

Enable SCIM on Azure Active Directory​

Before you start, make sure you have SSO set up for your organization. Then just follow the next steps to generate a SCIM token and add the Kisi Physical Security app in Azure.

Generate your SCIM Token in Kisi​

  1. Sign in to Kisi as the organization owner
  2. Under Organization setup click on SSO & SCIM
  3. Disable SCIM and click Save
  4. Re-enable it and click on Generate Token
  5. Copy the token (shown once)

Set up SCIM with Azure​

  1. Sign in to your Azure Active Directory portal
  2. Click on Enterprise applications
  3. Under All Applications, select your Kisi Physical Security application
  4. Navigate to the Provision User Accounts card and click Get Started
  5. Change provisioning mode from Manual to Automatic
  6. Add https://api.kisi.io/scim/v2 as the Tenant URL and enter your SCIM token in Secret Token field
  7. Click Test Connection to verify if the test succeeds before clicking Save
  8. Under Settings you can define whether both groups and users should be synchronized. Add an email address that will receive an alert if the synchronization fails.
  9. Navigate back to Enterprise applications, choose Kisi Physical Security and click on Users and groups
  10. Add any groups and users you want to sync with Kisi
  11. Go back to Provisioning and click Start provisioning (greyed out means it's already running)

You can sync single users on demand under Provisioning > Provision on demand. Groups cannot be synced on demand.

note

The initial Azure Active Directory sync is triggered immediately after you enable provisioning. Subsequent syncs are triggered every 20-40 minutes, depending on the number of users and groups in the application. This means that any updates in Azure might take between 20-40 minutes before they are propagated to Kisi.

Import users from Azure Active Directory​

Customers who don't yet have SSO set up can still import users from their Azure Active Directory by manually setting up the integration. We recommend, however, setting up SSO to allow your Kisi users to log in with their single, existing credentials.

To be able to set this integration up, you need to have global admin permissions in Azure.

  1. Sign in to Kisi
  2. Under Organization Setup, select Integrations and click Add Integration
  3. Enter a name, open the Type dropdown and select Azure Active Directory User Import
  4. Click Authorize with Microsoft and you’ll be redirected to the Microsoft Authentication screen
  5. Sign in with your Microsoft account that has admin privileges
  6. Click Accept to allow the integration read access
  7. Once back in Kisi, select the Active Directory Group
  8. In the User Email Property section, choose between User Principal Name and Mail as the attribute you want to use for this integration and that contains the user's email address in Azure AD. The default value is User Principal Name.
  9. Define if the import should be done into a Kisi group or as users only
  • For the group option, map the Azure Group to the Kisi Group. A Kisi Group is needed to share access to your place(s) with your users.
  • For the users only option, users will be imported but won't receive an invitation email from Kisi or have any access in your place(s).
  1. Click Add

The integration will be set up immediately. Everyone in the Azure Active Directory Group will get an email notification that Kisi access has been shared with them, unless you chose to import as users only.

Last updated on by KatalinH16