# Entra ID

> Integrate Microsoft Entra ID with Ironchip over secure LDAP with Entra Domain Services: Azure requirements, an LDAP key group in Ironchip, and access.

URL: https://docs.ironchip.com/en/identidad/integraciones/saas/entra-id/

Microsoft Entra ID (formerly Azure AD) is a cloud-based identity and access management service. It helps your employees access external resources, such as Microsoft 365, the Azure portal, and thousands of other SaaS applications. It integrates with Ironchip over the LDAP protocol, through Microsoft Entra Domain Services (formerly Azure AD DS).

Each new tenant comes with an initial domain name, `.onmicrosoft.com`, which you can't change or delete. You can add your organization's own domain names, which helps you create usernames your users recognize. For more information, see the [Microsoft documentation](https://learn.microsoft.com/en-us/entra/fundamentals/).

## Requirements

- Access to the Ironchip admin console.
- A user with permission to configure Azure.
- An active Azure subscription and a Microsoft Entra ID tenant associated with the subscription.
- Microsoft Entra Domain Services enabled and configured on the tenant.

## Configure Azure

Microsoft Entra Domain Services must meet these requirements to integrate with Ironchip:

- **Secure LDAP enabled**:
  - Create the necessary certificates.
  - Allow secure LDAP access over the internet. You can use an Azure network security group rule to limit that access.
  - Configure the groups you want to synchronize.
  - Create a subdomain that points to the external IP address of secure LDAP. This is required if you want to connect with TLS in secure mode, because the client certificate must match the host.
- **User configuration**:
  - Federated users: not supported.
  - Users synchronized from on-premises: in hybrid environments, make sure password hash synchronization is enabled. If it already is, run the cmdlet described in [Microsoft's guide](https://learn.microsoft.com/en-us/entra/identity/domain-services/tutorial-configure-password-hash-sync#enable-synchronization-of-password-hashes) to apply it.
  - Cloud users: even if the user was already created in the cloud, they must sign in and change their password.

:::note
Users and service accounts can't perform simple LDAP binds if you disabled NTLM password hash synchronization in your managed domain. See the Microsoft documentation on securing your managed domain.
:::

For more information, see the [official Microsoft tutorial on configuring LDAPS](https://learn.microsoft.com/en-us/entra/identity/domain-services/tutorial-configure-ldaps).

## Configure Ironchip

When you finish the Azure configuration, create a key group (password policy) in Ironchip with the LDAP protocol that points to Microsoft Entra Domain Services. See [Authentication policies](https://docs.ironchip.com/en/identidad/conceptos/politicas/) for details.

1. In **Authentication policies**, open the **Password policies** section and click **Add password policy**.
2. Add the name (**LDAP name**) and the server (**Server host**). If you want to enable secure TLS (**Enable TLS**), also add the certificate.

   [Image: Add a new password policy window with the LDAP name, the server, TLS encryption, and the certificate]

3. Ironchip checks that the connection works by asking you for a sample username (UPN or email) and LDAP password, which are not stored.

   [Image: Test window asking for the UPN or email and the LDAP password, which are not stored]

You can modify any field later: each time you do, Ironchip checks the connection again. Once the group is created, you can also test it with different users from its options.

## Configure the access

With the LDAP key group created, set it up in an access to start the authentication process.

:::caution[The username is not the Azure username]
An application's username in Ironchip is not the same one used to authenticate with Entra ID. For Entra ID, the user's own email address is used.
:::

## Verify the integration

1. Start authentication in the application like any other, with the username you configured earlier.
2. If the access requires an LDAP key group, a prompt appears asking you to enter your email password.
3. If you configured the access with another type of key group, such as your device, open the Ironchip app to finish the process and sign in to the application.