Configure SSO for Azure AD

Creating an R+ Azure Active Directory Application

Assumption is a directory already exists at the customer site. If not, customer’s IT will need to provision an Azure Active Directory installation, and configure synchronization to their OnPrem directory themselves. We have included a guide below that should guide administrators through that process.

High level steps are as follow:

• Create Replenishment Plus Enterprise Application inside customer Azure AD

• Configure Application for customer’s R+ instance(s)

• Note customer’s directory tenant/domain. By default this is a subdomain of onmicrosoft.com, but can also be configured with a custom domain. (i.e. ddtechtest.onmicrosoft.com, demanddriventech.com, etc)

• Note customer’s Replenishment Plus Application ID

­Create Enterprise Application

First, navigate to the Azure AD in Azure’s portal. Select Enterprise Applications from the left side.

New application

Create your own application

A side bar will appear. Enter the name of the name of the application. IE: "Replenishment Plus". Select the option "Register an application to integrate with Azure AD (App you're developing)"

Set application name, and redirect URI. If you have multiple instances, additional URIs may be added after creation. Depending on your organization policies, you will may want to restrict access to this Application API to the organization only.

Visit the App Registration page for your new app, Authentication section

Select "ID tokens (used for implicit and hybrid flows)"

Note Application (Client) ID on the main application page

Configure R+

Log into R+, navigate to Site Administration > Accounts & Access > Azure Active Directory.

Assign Azure AD application values

Saving these values will actually restart the R+ application, terminating any active background jobs. So please complete any active processes before doing this.

Select default user roles

R+ doesn't currently map any SSO groups to in app roles. So a default role assignment may make sense for customers to aide in initial on-boarding.

Logging Into R+ via SSO

With the proper Enterprise Access License enabled, users will be presented with an additional option on the login page.

Must be configured inside R+ before this link will function.

Approve Permissions Request

Azure Active Directory requires consent before R+ can read directory information.

You can also optionally consent for the entire organization (If you are an admin) so your users will not see this message.

Accept Permissions Request

Enabling local passwords

Some user accounts can "multi-home", where they have a local password, but can also log in with their SSO credentials. By default this is disabled.

Without Allow Local Password enabled, users cannot reset their passwords, and password policy options will not be enforced.