Setting Up Azure Active Directory

Log in to the Azure Management Portal as a Global Administrator user.
In the left pane, click Azure Active Directory.
In the Azure Active Directory blade, under Manage, click Enterprise applications.
Click + New application.
Under Add an application: Add your own app, select Non-gallery application:
In the Name field, enter lookout_saml and click Add.
Click Configure single sign-on (required):
On the Single Sign-on Mode page, click SAML.
On the 1. Basic SAML Configuration tile, click the edit icon in the top-right corner and enter the following:

Field Value
Identifier (Entity ID) Provided by Lookout. The /metadata URL for your Lookout tenant.
Reply URL The same URL as above, but ending in /acs instead of /metadata.
On the 2. User Attributes and Claims tile, click the edit icon in the top-right corner.
Delete all existing claims by clicking the … icon on the far right of the row and clicking Delete:
On the Groups returned in claim: line, click the edit icon on the far right.
Set the following:
Field Value
Which groups associated with the user should be returned in the claim Security groups
Source attribute sAMAccountName
Customize the name of the group claim (Checked)
Name (required)
memberOf
Click Save.

Field	Value
Identifier (Entity ID)	Provided by Lookout. The `/metadata` URL for your Lookout tenant.
Reply URL	The same URL as above, but ending in `/acs` instead of `/metadata`.

Field	Value
Which groups associated with the user should be returned in the claim	Security groups
Source attribute	sAMAccountName
Customize the name of the group claim	(Checked)
Name (required)	`memberOf`

Create the attributes below by clicking + Add new claim and setting the specified Name, Source, and Source attribute:


Name	Source	Source attribute	Description
`givenname`	Attribute	user.givenname	The user's first name.
`sn`	Attribute	user.surname	The user's last name.
`mail`	Attribute	user.mail	The user's email.
`upn`	Attribute	user.mail	The user's principal name in Active Directory.

Leave the Namespace field blank, then click Save.

Create an ent attribute by typing the Source attribute value rather than selecting it from the dropdown:

Name Source Source attribute Description
ent Attribute
Example:

" 78902dc0-b8ab-4abc-12c7-4a2b980ec23a"
Your Lookout enterprise tenant GUID, provided by Lookout
Click Save.
In the left pane, click Azure Active Directory.
In the Azure Active Directory blade, under Manage, click App registrations.
Switch to All applications view and search for the lookout_saml app that you just created:
Under Manage, click Manifest.

Name	Source	Source attribute	Description
ent	Attribute	Example: " `78902dc0-b8ab-4abc-12c7-4a2b980ec23a`"	Your Lookout enterprise tenant GUID, provided by Lookout

Using the included User application role as a template, create entries for Full Access, Restricted Access, and Read-Only administrators by changing the description, displayName, and id for each role:

"appRoles": [
        {
            "allowedMemberTypes": [
                "User"
            ],
            "description": "Lookout MES Console full access admin",
            "displayName": "cld.azu.lookoutconsole.fullaccess",
            "id": "18d14569-c3bd-439b-9a66-3a2aee01d14f",
            "isEnabled": true,
            "lang": null,
            "origin": "Application",
            "value": null
        },
        {
            ...
            "description": "Lookout MES Console restricted access admin",
            "displayName": "cld.azu.lookoutconsole.restricted",
            "id": "b9632174-c057-4f7e-951b-be3adc52bfe6",
            ...
        },
            {
            ...
            "description": "Lookout MES Console read-only",
            "displayName": "cld.azu.lookoutconsole.readonly",
            "id": "b9632174-c057-4f7e-951b-be3adc52bfe6",
            ...
        },

Click Save.
You may need to wait a few minutes for AAD to apply the new roles to the application.
In the left pane, click Azure Active Directory.
In the Azure Active Directory blade, under Manage, click Enterprise applications and select the lookout_saml app.
In the Enterprise Application blade, under Manage, click Users and groups.
Click +Add user to assign users or groups to the application so that they can use SSO.
Select users and groups and assign them to the application roles you created in Step 22 to control their access to the Lookout MES Console:
Click Assign.

Lookout Product Documentation

Find answers about using and optimizing Lookout products.

Setting Up Azure Active Directory

lookout-footer