# MS Entra ID Integration

Cloudbrink's Personal SASE has granular role-based access controls, enabling administrators to assign different users and groups to needed public and private resources. Rather than requiring customers to manually define these users and groups, Cloudbrink instead integrates with the customer’s existing identity provider. This enables organizations and their end-users to utilize existing single sign-on methods, simplifying onboarding and management. This document covers configuring Cloudbrink with Entra ID. 

#### **Overview:**

Microsoft Entra Identity, commonly known as Entra ID, is a comprehensive identity and access management solution designed to enhance security and streamline user access across various platforms. Its key benefits include robust authentication mechanisms, centralized identity management, and simplified access controls. Entra ID facilitates secure and efficient user access, reducing the risk of unauthorized access and data breaches. By offering features like multi-factor authentication and single sign-on, it greatly improves the user experience while maintaining high security standards. This makes Entra ID an ideal choice for organizations looking to strengthen their cyber- security infrastructure and optimize user access management with Cloudbrink. 

**Prerequisites** 

Administrative access into the Cloudbrink Administrators portal 

Administrative access into the Microsoft Entra ID portal 

Cloudbrink Entra ID signing certificate provided from <support@cloudbrink.com>&#x20;

<br>

**Configure Authentication Policy**&#x20;

1. Navigate to the Cloudbrink Admin portal admin.cloudbrink.com&#x20;
2. Navigate to **Configure > Policies > Authentication > Add New**&#x20;

<br>

<figure><img src="/files/hmE2naysnta1d4OyXA6Z" alt=""><figcaption></figcaption></figure>

<br>

3. Under SAML SSO, Input a unique Auth Policy Name, Email Domain, Login URL, Metadata URL NOTE: Ensure that Metadata URL and Login URL values contain “microsoftonline.com” in the path <br>
4. Save the SAML auth policy&#x20;
5. Open the newly created authentication policy by clicking on “Update” from the menu on right-side&#x20;
6. Copy the ACS URL to a notepad&#x20;
7. Download the IDP certificate. This certificate needs to be uploaded to the Entra ID app that would be created for the Cloudbrink login service. Download operation will prompt admin to set the password for the PFX certificate.&#x20;

<figure><img src="/files/HolMbJwO5mwiYkwZSdzP" alt=""><figcaption></figcaption></figure>

<br>

8. Navigate to the Entra ID portal. <br>

<figure><img src="/files/UE19DdIgywOHgOAWQQrf" alt=""><figcaption></figcaption></figure>

9. Navigate to Enterprise Applications on the left hand panel <br>

<figure><img src="/files/QZ5RAaqZ09kVoXREQ6rh" alt=""><figcaption></figcaption></figure>

10. Click ![](/files/t5BaU1ft0INRMBsBveDd) to create a new Enterprise Application for Cloudbrink&#x20;
11. Click ![](/files/ECBwS2jyB02N6oz8QWGJ) and fill out the name of the app, as well as ensuring that "In- regrate any other application you dont find in the gallery (Non-gallery) is selected. Hit save.&#x20;

<figure><img src="/files/Ab86MxROm1hpMtLhh7hQ" alt=""><figcaption></figcaption></figure>

12. On the next screen, select 1. Assign users and groups&#x20;

<figure><img src="/files/WHAr9M4M1KryGNgU2C5S" alt=""><figcaption></figcaption></figure>

Select ![](/files/4zVZqOc0xHBcJD5pDAcc) and select the group(s) you'd like to have access via Cloudbrink.&#x20;

Note: While here, you should copy the group "Object ID" value(s) and put them in your notepad from earlier. These will be used to map groups to access levels in the Cloudbrink admin portal later.&#x20;

<figure><img src="/files/nHAqaJtKS09WRs6cmXo8" alt=""><figcaption></figcaption></figure>

13. After you've added the groups required, from you Enterprise App menu, Select "Single sign-on" and then "SAML" from the left hand panel under manage.&#x20;

<figure><img src="/files/sVSRyprFAjj3Zx6NSWWO" alt=""><figcaption></figcaption></figure>

\
14\. Copy the "Login URL" lower on the page under number 4 to your notepad.&#x20;

<figure><img src="/files/dKM70tTUbOQuwqbvoLy1" alt=""><figcaption></figcaption></figure>

15. Click "Edit" on the Basic SAML Configuration

<figure><img src="/files/TKKfVH3vjYyzoaLk0sBf" alt=""><figcaption></figcaption></figure>

16. Under the right hand window, fill in the following fields: I

&#x20;     a) Identifier (Entity ID): <https://wren.cloudbrink.com/\\><example>/svc/auth/\<example> This is copied from step 4 above&#x20;

&#x20;     b) Reply URL: <https://wren.cloudbrink.com/\\><example>/svc/auth/\<example> Same as above    &#x20;

&#x20;     c) Sign on URL: <https://login.microsoftonline.com/\\><example>/ Copied from step 12. <br>

17. Once all above fields are filled appropriately, hit save on the top left.&#x20;

<figure><img src="/files/2X81k6Z6eR61MNKoMSVd" alt=""><figcaption></figcaption></figure>

18. Click edit on the Attributes & Claims section&#x20;

<figure><img src="/files/5eOGc9vw7Zq2LYRVnxzz" alt=""><figcaption></figcaption></figure>

19. Click on Add new claim and fill out the following fields (non-specified fields can be left as de- fault), and then click Save:&#x20;

a) Name: Email&#x20;

b) Source attribute: user.mail&#x20;

<figure><img src="/files/Brty6krqxl0owV6SLgum" alt=""><figcaption></figcaption></figure>

20. Click Add a Group claim and in the pane that appears to the right, enter in the following fields and click Save:&#x20;

a) Which groups associated: Security groups&#x20;

b) Source attribute: Group ID&#x20;

c) Advanced options:&#x20;

&#x20;   i) Customize the name of the group claim: Checkbox selected Groups&#x20;

&#x20;   ii) Name (required): Groups \ <br>

<figure><img src="/files/NmnPovRahhbscVhH7aZq" alt=""><figcaption></figcaption></figure>

21. Back within the Single sign-on section of the application, under the 3 SAML Signing Certificate section, copy the App Fedearation Metadata URL to your notepad.&#x20;
22. Click the three little dots on the top right corner under the SAML Certficates window and click  Edit.&#x20;

<figure><img src="/files/0xqjF7Z9djPQ7zeuOFk6" alt=""><figcaption></figcaption></figure>

\
23\. In the pane that appears to the right:&#x20;

&#x20; a) Click Import Certificate, and select the .PFX certificate downloaded from the admin portal&#x20;

&#x20; b) While importing the file, enter in the password specified while downloading the IDP cert&#x20;

&#x20; c) Ensure the certificate is set as Active&#x20;

&#x20; d) Change the Signing Option to Sign SAML response and assertion&#x20;

&#x20; e) Optionally, input a Notification Email Address to be notified of cert expiry reminders&#x20;

<figure><img src="/files/RXvqU1Z8faltrX4gtLAv" alt=""><figcaption></figcaption></figure>

<br>

24. Navigate back to the Cloudbrink Admin Portal and to your Authentication Policy&#x20;
25. Paste in the Metadata URL, and Login URL as copied to your notepad in steps 12 and 19. Then click the checkmark in the top right corner to save

<figure><img src="/files/tL1iFUr3DwPCux3p0WJB" alt=""><figcaption></figcaption></figure>

26. Navigate to Device User Groups&#x20;
27. For every group you desire to use with Cloudbrink for login, create a corresponding device user group the Device User Group value being the Entra-ID Group Object ID&#x20;

<br>

<figure><img src="/files/oGIeBlshefmv5PrsPeBl" alt=""><figcaption></figcaption></figure>

28. Create a new Device User Group Policy, and select the desired Resource Template. Optionally, select your desired DSPA Policy, Device Session Policy, and Mobile Access Policy&#x20;

<figure><img src="/files/4uoOcmpxqEPDMLHWJ7Rx" alt=""><figcaption></figcaption></figure>

29. Users logging in to the BrinAgent with the configured group will then have the desired policies applied&#x20;


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.cloudbrink.com/configuration/ms-entra-id-integration.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.