To synchronize users and groups between Access and Azure: 1. With SCIM, Cloudflare Access can automatically deprovision users after they are deactivated in the identity provider and display synchronized group names in the Access policy builder. The Azure AD integration supports the System for Cross-domain Identity Management (SCIM) External link icon Open external link protocol. To test that your connection is working, select Test. (Optional) If you are using Azure AD groups, enable Support Groups. PKCE will be performed on all login attempts. (Optional) Enable Proof of Key Exchange (PKCE) External link icon Open external link.

Įnter the Application (client) ID, Client secret, and Directory (tenant) ID obtained from the Azure dashboard.

In Zero Trust External link icon Open external link, navigate to Settings > Authentication. Once all seven permissions are enabled, select Add permissions.

More narrow permissions may be used, however this is the set of permissions that are tested and supported by Cloudflare.

Select Delegated permissions and enable the following permissions External link icon Open external link:

Store the client secret in a safe place, as it can only be viewed immediately after creation.įrom the App registrations page for your application, navigate to API permissions.

Īfter the client secret is created, copy its Value field.

Name the client secret and choose an expiration period. Navigate to Certificates & secrets and select New client secret. Copy the Application (client) ID and Directory (tenant) ID. Next, return to the Azure Active Directory menu and go to App registrations.

You can find your team name in Zero Trust under Settings > General.

Azure sso login