Microsoft Entra ID Integration Process

1. Identify:
   • Current Shibboleth attributes used
   • Authentication vs authorization dependencies
2. Ask:
   • What attributes are needed?
   • What exists in Azure AD? 

If required attributes are not present in Entra ID, additional steps such as attribute mapping, directory extension, or alternative data sources may be needed. Coordination with Information Services (IS) is recommended in these cases.

The process typically begins with a review of the existing Shibboleth integration. This includes identifying which attributes are currently used and determining whether they remain necessary.

1. Contact the application vendor
2. Confirm:
   • Do they support Entra?
   • How many customers use it?
3. Compare Entra Integration:
   • Vendor documentation vs Microsoft documentation

Microsoft docs are often more accurate

At the same time, it is important to engage with the application vendor to confirm their level of support for Entra ID. Most applications already support Entra, but it is important to compare the Entra integration documentation of the applications to the Microsoft documentation.

Once requirements are validated, configuration is completed in both Entra and the vendor application. The level of involvement from the service owner, vendor, and Information Services (IS) will vary depending on the application.

Entra Configuration (IS / Service Owner)

In Entra

• In Entra, configure the application using one of the following:
  • Enterprise Application (SAML)
  • or App Registration (OIDC)

• Reply URL (ACS)
• Entity ID
• Claims (attributes)
• Certificates

Once requirements are understood, the integration is configured in Entra. This involves creating the application, defining identifiers and endpoints, and mapping claims to match the application’s expectations.

Vendor Configuration:
Configuration must also be completed on the vendor/application side. Depending on the application, this may involve either:

• A self-service admin interface where settings such as Entity ID, Reply/Redirect URL, Logout URL, and certificates can be updated directly, or
• Coordination with the vendor’s support team to apply these settings on their end

Timing and Support Expectations

Configuration timelines vary depending on the application and vendor.

• Entra setup can often be completed quickly once all required information is provided, either through a Service Request (SR) or as part of a scheduled change
• Overall timing depends on vendor responsiveness, attribute requirements, and testing needs

General guidance:

• Simple integrations may be completed within a few business days
• More complex or vendor-dependent integrations may take longer

1. Configure Entra fully
2. Choose cut over time
3. Switch:
   • From Shibboleth to Entra
4. Monitor
5. Rollback option:
   • Flip back to Shibboleth if needed

A communication plan should be included in the production cut-over. Before rollout, it is recommended to notify the IT Pro's teams group, so support staff are aware of the change and prepared to handle potential issues. Broader user-facing communications should be tailored based on the department of the service. Larger or widely used services may require advance notice to the university community, while smaller services may only require targeted messaging.