Connecting your identity provider to the Confidencial Key Server

Microsoft Entra ID (formerly Azure Active Directory)

1. Log in to the Microsoft Azure portal

2. Click Microsoft Entra ID

3. Click App registrations from the side menu

4. Click New Registration from the top toolbar

5. Ensure the following settings are entered:

   1. Name: Confidencial-OPKSS

   2. Supported account types: Select either “Accounts in this organizational directory only,” “Accounts in any organizational directory,” or Accounts in any organization directory and personal Microsoft accounts,” depending on who you want to be able to join your Confidencial organization

      ℹ️ Most organizations will want to select “Accounts in this organizational directory only,” as users outside your organization can log in to Confidencial via their own organization account or via an individual account.

   3. Redirect URI: Choose “single-page application (SPA)” in the Select a platform drop down menu and enter https://my.confidencial.io/auth-management in the input box

6. Click Register

7. Click Manifest (under Manage), then

   1. Change the value of acceptMappedClaims (Line 3) from null to true

   2. Click Save

8. Return to the main Entra page and click Enterprise applications from the side menu

9. Click Confidencial-OPKSS in the list of applications

10. Click Single sign-on (under Manage)

11. Click the Edit button for Attributes and Claims

12. Click Add new claim

    1. Input a Name of https://confidencial.io/email, Source will be Attribute and Source attribute will be user.mail.

    2. Click Save

13. Click Add new claim

    1. Input a Name of org_id, Source will be Transformation, and data will be entered like the following values:

       1. Transformation: RegexReplace()

       2. Parameter 1: Attribute

       3. Attribute name: user.city

       4. Regex pattern: ^.*$

       5. Replacement pattern: This value will be provided by your Confidencial support representative

    2. Click Add to add the transformation

    3. Click Save

14. Return to the main page for the enterprise application Confidencial-OPKSS

15. Click Properties (under Manage) from the side menu

16. If you want to specify the users that can log in to Confidencial, set Assignment required to “Yes,” otherwise, all users* will be able to log in to Confidencial

    ℹ️ All users with a supported account type specified in Step 5.b above

ℹ️ This completes creation of the Entra ID application and generates a *Client ID* that must be securely transmitted to Confidencial during account set up (along with the *Entra Domain*). Optionally, you may continue to the next section to configure automatic user and group provisioning via SCIM.

Configuring user and group synchronization with SCIM in Entra ID

1. Click Enterprise applications from the Entra ID main menu

2. Click New application

3. Click Create your own application

4. For the name of the application, enter Confidencial-OPKSS-SCIM

5. Select Integrate any…(Non-gallery) from the list of options and click Create

6. Select Users and groups (under Manage) from the side menu

7. Associate users and groups to this new application. These are the users and groups that will be automatically synchronized with Confidencial.

8. Click Provisioning (under Manage) from the side menu. You may have to select Provisioning (under Manage) a second time to display the Provisioning Mode setting.

9. Set Provisioning Mode to Automatic

10. Under Admin Credentials, enter the following settings:

    1. Tenant URL: https://opkss.confidencial.io/{orgId}/scim/v2/?aadOptscim062020, where {orgID} is your organization’s ID, which is provided by your Confidencial support representative

    2. Token: This is the SCIM token created by signing into confidencial.io application and generating a token under the organization settings page as an admin.

    ℹ️ The Entra ID implementation requires the `?aadOptscim062020` parameter to achieve full SCIM compliance.

11. Test your connection settings — If there are any issues here please reach out to a Confidencial support representative for further assistance.

12. Click Save

13. Click Overview

14. Click Start provisioning

ℹ️ By default, the provisioning interval is set to 40 minutes; this, as well as the ability to send an email notification when a failure occurs, can be adjusted by clicking the Settings dropdown menu.