How to integrate Security Center with Microsoft Entra ID using OpenID Connect - Before Security Center can use Microsoft Entra ID to authenticate users with OpenID Connect, setup is required in Config Tool and the Microsoft Entra ID Portal. - Security Center 5.13

1 - Preparing Security Center

1. Open Config Tool and connect to the Security Center main server as an administrator.
2. From the Config Tool homepage, open the System task and click the Roles view.
3. Click Add an entity () > Authentication Service.
   

   The Creating a role: Authentication Service window opens.

4. In the Specific info section, select the identity provider and the authentication protocol and click Next.

   Provider

   AzureAD

   Protocol

   OpenID Connect

   

5. In the Basic information section, enter a name and optional description for the new Authentication Service role.

   

6. If there are partitions in your system, select the partition of which this role is a member and click Create.

   Partitions determine which Security Center users have access to this entity. Only users who have been granted access to the partition can see this role.

7. From the App registration page, copy the redirect and logout URIs.

   For more information, see About role endpoints configuration.

8. Click Suspend > Save.
   NOTE: The Suspend button allows you to save and exit the configuration wizard temporarily. You can suspend the configuration at any time during the process.

2 - Preparing Microsoft Entra ID

1. In the Microsoft Entra ID Portal, open the Microsoft Entra ID for your tenant.
2. In the left menu, select App registrations and click New registration.

   

3. Enter a Name, select Single tenant under Supported account types and click Register.

   

4. In the left menu for your application, select Authentication, click Add a platform, and select Web.

   

5. In Configure Web, enter the first redirect URI for Security Center to Redirect URIs and click Configure.

   

   NOTE: OIDC doesn’t require the explicit Logout URL.
6. Under Redirect URIs for the Web platform, click Add URI, enter the remaining redirect, logout URIs for Security Center, and click Save.

   

7. In the left menu for your application, select Certificates & secrets, open the Client secrets tab, and click New client secret to generate a client secret for Security Center.

   

   Best Practice: After generating your secret, copy it from the Value column header and keep it safe until the integration is complete. It’s impossible to retrieve a client secret from the Microsoft Entra ID configuration. If the secret is lost, you must generate a new one.

   

   NOTE: You can also add a certificate credential to configure client authentication. For more information about client authentication, see Configuring client authentication in OpenID Connect.
8. In the left menu for your application, select Token configuration.
9. Click Add groups claim, select the group type you want to grant access to Security Center, select Group ID for the Access token type, and click Add.

   

   IMPORTANT: To avoid hitting a group overage claim, we recommend that large enterprise systems select Groups assigned to the application instead of All groups in the Edit groups claim section. See this Microsoft Learn topic for more information.
10. Click Add optional claim, select the Access token type, select the UPN claim, and click Add.
    NOTE: Security Center requires a unique identifier for the user. UPN is one possibility, but other optional claims, such as email, can be used instead.

    

11. In the left menu for your application, select Manifest, set accessTokenAcceptedVersion to 2, and click Save.

    

12. In the left menu for your application, select Expose an API.
13. Click Add next to Application ID URI to specify a globally unique URI for the Security Center application, and click Save.

    

    Microsoft Entra ID automatically generates a usable URI. You can use the default or change it as required.

    

14. Click Add a scope, fill in the required fields with values of your choice, and click Add scope.
    NOTE: A custom scope ensures that Microsoft Entra ID targets Security Center. The scope can specify anything.

    

3 - Integrating Security Center with Microsoft Entra ID

• Before configuring an Authentication Service in Security Center, you must register the redirect and logout URIs in the Microsoft Entra ID Portal.
• The system validates the properties at each step before you can proceed.

1. In Config Tool, select the Authentication Service role created earlier and click Configuration.

   The App registration page of the Creating a role: Authentication Service window opens and you can resume the configuration.

2. On the App registration page, click Next.
3. On the Communicate with provider page, click Start, enter an issuer URI and application (client) ID, and click Next.

   

   Issuer

   Secure URL (HTTPS) pointing to the OpenID Connect metadata document. Copy it from Endpoints in the Microsoft Entra ID application configuration.

   Application (client) ID

   A unique identifier that represents Security Center in Microsoft Entra ID. Copy it from Overview in the Microsoft Entra ID application configuration.

   

4. In the Metadata section, enter the URL and click Next.

   URL

   Secure URL (HTTPS) pointing to the OpenID Connect metadata document. Copy it from Endpoints in the Microsoft Entra ID application configuration.

5. On the Accepted domains page, configure the Default provider option:
   • This option is turned off by default. When turned off, you must add at least one domain name of users who can authenticate using this Authentication Service.

     

   • Turn on the Default provider option to use this identity provider to authenticate users from all domains.

     If you have multiple Authentication Service roles, only one role can be set as the default provider, and this option is disabled for all other roles.

     CAUTION:
     Turning on the Default provider option deletes all domain names that were previously added.
6. Specify whether or not to use this identity provider as a sign in option.

   If you select Yes, enter the name of the identity provider to be displayed on the sign in screen with the text "Sign in with <display name>".

7. Click Next.
8. (Optional) On the Client authentication page, turn on Proof Key for Code Exchange (PKCE) and configure the Confidential client option. For more information about client authentication, see Configuring client authentication in OpenID Connect.
9. On the Claims and scopes page, select the following properties:

   Username claim

   OpenID claim returned by the identity provider that contains the username of the authenticated party.

   Select: preferred_username

   Group claim

   OpenID claim returned by the identity provider that contains the groups the authenticated party belongs to.

   Select: groups

10. Click Next.
11. On the Groups page, click Add an item (), select an existing group or create a new user group, and click Next.
    Tip: You can bulk download user groups from Microsoft Entra ID as a CSV file and import those groups into Security Center. The external unique identifier of the imported groups must match the Object Id of those groups in Microsoft Entra ID.
12. On the Test the configuration page, click Test logon to validate the configuration, and click Next.

    For more information, see Testing a third-party authentication setup.

13. On the Creation outcome page, verify that the information is correct and click Next > Close.