Entra ID Authentication (OIDC)

1. In Ivanti Neurons Platform navigate to Admin > Authentication.
   The Authentication page appears.
2. In the External Authentication (SSO) section, click Configure & Enable.
   The Enable External Authentication (SSO) page appears.
3. From the Provider drop-down select Entra ID.
   The Entra ID Configuration Settings appear.

Before you can continue with the Ivanti Neurons configuration you must first carry out some steps in Microsoft Azure Portal.

Before you can continue with the Ivanti Neurons configuration you must first carry out the following steps in Microsoft Azure Portal.

Step A - Create your Entra ID application

1. Login to Entra ID Admin Center as Office 365 Administrator.

2. In the sidebar menu click Entra ID > App registrations.
   The App registrations dashboard appears.
3. Click New registration.
4. Enter an appropriate name for the application, and accept the default supported account types: Accounts in this organizational directory only.
   
5. Under Redirect URI section, select Web from the Select a platform drop-down. Enter the Redirect Uri, as displayed in the Neurons Platform Entra ID Configuration Settings.
6. Click Register at the bottom of the dialog.
7. Once the app registration is complete, a success message is displayed and redirected to the overview page of the registered application.
   

You need to record the application (client) ID and Directory (tenant) ID as it is required for the next stage of the setup in Ivanti Neurons.

Step B - Configure Authentication Settings

1. On the created app, navigate to Manage > Authentication (preview).
2. Navigate to Settings.
3. In the Implicit grant and hybrid flows section, make sure the ID tokens check box is selected.
   
   
4. Enter the Logout Url in the Front-channel logout URL field, as displayed in the Neurons Platform Entra ID Configuration Settings.
5. Click Save.

Step C - Create a Secret

1. On the created app, navigate to Manage > Certificates & secrets.
2. Under the Client secrets tab, click New client secret.
3. Add a description.
4. Select the expiry duration in-line with your company standards.
5. Click Add.
6. A value is created, you must copy it somewhere safe because this is the only time it can be viewed.

Make sure you copy the Secret Value and not the Secret ID.

Entra ID setup is now complete and you can return to Ivanti Neurons Platform.

The Secret lifetime is finite, so your company should take measures to ensure this is replaced prior to expiry to avoid any outages to Ivanti Neurons. Learn how to Update Client Secret.

Step D - Token Configuration

Set up token configuration so you can use auto provisioning.

1. On the created app, navigate to Manage > Token configuration.
2. Select Add Optional Claim to open the side panel.
3. For the Token type, select ID.
4. From the Claims list, select email, family_name and given_name. This allows the email, last name, and first name, to be obtained for new Ivanti Neurons members, which is a requirement when using auto provisioning.
5. Click Add.
   A Microsoft Graph permissions pop up appears.
6. On the Microsoft Graph permissions pop up, select the checkbox and click Add.

Step E - Grant Permissions

If the user setting up SSO is not an Azure administrator, then the Azure administrator needs to log in to Azure and approve the Apps request for User-read/Signin permissions.

1. Select Manage > API permissions for the EntraID application. You must be logged in as an Azure administrator.

2. If the checkbox was selected during Token Configuration, few permissions including User.Read would have already been added to Microsoft Graph as Delegated permissions.

3. If User.Read is not listed as a delegated permission, you need to add the permission. To do this:
   • Select Add a permission.
   • Select Microsoft Graph > Delegated permissions.
   • Select the User.Read permission.
4. Select Grant Admin Consent for <entraid_tenant>.

Once you have created the Entra ID application (client), directory (tenant), and secret, you can continue with the Ivanti Neurons Platform configuration.

1. Return to the Entra ID Configuration Settings page (Ivanti Neurons Platform > Authentication > External Authentication (SSO) > Configure and Enable.

2. Enter the Directory (Tenant) ID from Entra ID app registration.
3. Enter the Application (Client) ID from Entra ID app registration.
4. Enter the Client secret value that was generated and saved.
5. Enter the Client secret expiry date, this should match the expiry date specified when creating the client secret. See Update Client Secret for further details.
6. Click Continue to display the Validate Connection Settings page.

You need to connect with your Entra ID credentials to validate your connection settings.

1. On the Validate Connection Settings page, click Validate Settings to access your organization's sign-in page via a new tab, enter your Entra ID credentials and proceed to sign-in. If you are already signed in credentials are not required and the validation takes place automatically, so make sure you are signed in to the account you want to authenticate.
   You will receive a confirmation screen if login is successful.

The Azure username must exactly match your Ivanti Neurons username.


2. Return to this tab (Validate Connection Settings).
3. Select the check box I confirm I have successfully validated my connection settings to confirm you have logged in successfully.
4. Click Continue to move on to convert Ivanti Neurons Platform accounts.
   The Enable Ivanti Neurons Platform accounts page appears.

Entra ID is now configured, but it is not enabled.

To enable, you need to convert your Ivanti Neurons Platform accounts to use Entra ID instead.

1. On the Enable Ivanti Neurons Platform accounts page, click Sign Out & Enable.
   The Ivanti Neurons Sign In page appears.
2. Select to Sign In with Entra ID and enter your Entra ID credentials, the conversion will then be complete.

The same user must configure Entra ID authentication and Sign in and validate the credentials in Ivanti Neurons, to avoid an Access Denied error.

All members will receive an email to confirm the account has been converted and that they must access the tenant with Entra ID credentials going forward. If the member does not have Entra ID credentials, they will not be able to access Ivanti Neurons.

External Authentication (SSO) will now display with an Enabled status.