In order for AAD to work, you need to make sure that the following requirements are met.

Access to your AAD Azure Account

Access https://portal.azure.com and loginlog in.

If you're able to see "Azure Active Directory" - you meet this requirement

Image Modified

NOTE: Azure Active Directory Group membership syncronization synchronization to DC requires Azure Subscription levels "Premium P1" or "Premium P2"

2: AD and ADFS must be disabled

Access the product or products (DC and or MM) you want to enable AAD login for and verify that you are met with the standard Digizuite login screen (and not ADFS or AD). 

If you are not met with a prompt - asking for you to login with AD or ADFS - you meet this requirement and can go ahead with configuring AAD.

The ID of

the user

you want all

new users to

inherit from (AAD Template User)

Per default the DAM Center is configured with two users, that are "copied" every time either a collection or self-signup user has been created by the system. These two are just users, just like any all the other users (the user named system excluded). The thing that sets them apart is that their passwords usually is something that's meant never to be written again, and that their member ID's have been set to be user IDs are called upon by the system every time a new user is to be created in its likeness.

Usually the self-signup template user named "self-sign up template user" has been set up correctly if you already is already present in your system when you have the self-signup functionality enabled in your Media Manager. If this is the case, usually this user can be used for automatic assigning of roles when creating AAD users. Remember Write down this user's user ID then (usually this is something like "300xx")

for later in the guide.

If you don't want to use the previously mentioned self-sign up template user, you'll, of course, have to create a new user. You do this by doing the following steps::

1. Login to your DAM Center with a Super Administrator or an Administrator user

2. Go to System tools → Users and groups → Users → System users and press Add

3. In the Username field, you type in "AAD Template User", in the password field you type in something random

   , and in the

   (Optionally: Metagroup field "User Config"

   and press create

   )

4. Press create (image below)

5. Image ModifiedNow
6. make a note about your new user's user ID

   Note down this new user’s user ID (image below)

7. Image Modified
8. Now edit

   Edit the user's roles by expanding the right-side

   Edit

   edit menu -

   and then

   make sure that you're in the view named "Standard" now add the following groups

   1. Internal access

   2. Light user or Content Creator

   3. Public access

   4. Trusted (usually

   ,

   5. already added

   by default

   6. )

9. Image Modified
Press save

10. Save

The ID you've noted down will be used in a upcoming section, where you have to edit some XML.

Create and map DAM Center groups to reflect your reflects Azure Active Directory Groups

Navigate to System Tools / → Groups in Dam Center / → Users and groups / →

Groups.

Create a Folder by right-clicking Groups and selecting Add folderImage Removed

Image Added

Name the new folder "Azure Active Directory"

Select the new Folder.

In the Azure Portal Navigate to "Azure Active Directory" / "Groups"Image Removed

Image Added

The Object Id is used to bind the Active Directory Group to a DamCenter DAM Center Group.

Repeat for each Azure Active Directory group that should grant access to DamCenterthe DAM Center

Click "Add", and Give the new DamCenter DAM Center Group a name.

Image Removed

Image Removed

Image Added

Image Added

Click "Create"

Select the new Group, and edit in the right pane.Image Removed

Image Added

• Fill the "Binding group name" with the object Id from the azure groups "Object Id" field

• Check the "Is Binding group" checkbox

• Select

  DamCenter Groups

  DAM Center groups, users that are

  member

  members of the Azure

  Group

  group should be member of.

• Click Save.

Repeat for each Azure group that should be mapped.

Make an App Registration for the DC in the Azure Portal

You have to enable AAD for the DC. All other applications that we support AAD for will inherit it from the DC.

You register your product by doing the following steps:

1. Access https://portal.azure.com with your Azure credentials, you have from the first requirement (Access to your AAD Azure Account)

2. Access "Azure Active Directory" (see image)

3. Image Modified

4. In here, press the "App registrations" beneath "Manage" (See image)

5. Image Modified

6. Now press the "New registration"

7. Image Modified

8. In the

   "The user-facing display name for this application (this can be changed later)." simply enter your DC's URL (this makes it easier to locate in the future - this could be anything)
9. In the Redirect URI (optional) you may insert your URL again (Note: In some upcoming steps, you have to add yet another Redirect URI)
10. Image Removed
Press theImage Removedbutton in the bottom
Make a note of the "Application (client) ID" - you need this for later

11. Image Removed
12. Click on "Redirect URIs"
13. Image Removed
14. Add yet another redirect URI with "/loginservice" appended:
15. Image Removed
16. Wing off ID tokens
17. Image Removed
18. Go to the upper right corner and press your profile card
19. Press "Switch Directory"
20. Copy the ID on the second line - the one encircled in the image
21.  Image Removed
22. Now go into the app registration. Press Settings, and then Properties
23. The last thing that has to be done, is to invite users to the

    form, set the “name” to something that is easy to remember and find again should that be needed.
    Set the “Redirect URI” to “https://{dc-url}/DigizuiteCore/LoginService”

    Image Added

24. On the application page, select “endpoints”
    

    Image Added

25. Find the “Federation metadata document” url, and save that somewhere convenient. This is the “Metadata address”
    

    Image Added

26. Next go to “Expose an api”
    

    Image Added

27. Look for “Application ID URI“ - on here, click on “Set“.

    Image Added

    Copy the App ID, and press “Save“

    Image Added

28. Lastly, invite users to your site. This is described in another guide. In short, access your site's registration in the "Enterprise Applications" tab in the AAD section, and take it from there.

Configuration

of the Active Directory Group

Membership synchronization mode.

Select Manifest in the left pane.

Modify the

JSON document, by modifying the line "groupMembershipClaims": null, to be e.g. "groupMembershipClaims":"SecurityGroup",

Image Removed

Image Added

Valid options for groupMembershipClaims are;:

• "All"

• "SecurityGroup"

• "DestributionList"

• "DirectoryRole"

see: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-optional-claims for more info.