Azure AD: 8x8 Single Sign-On (SSO) and User Provisioning (SCIM) Configuration

Add the 8x8 App to Azure

1. Log in to the Azure Active Directory admin center.
2. In Enterprise applications click New application.

3. In the Azure AD Gallery, search for 8x8. The icon will have a red background with white text. 
4. Select the 8x8 app, optionally rename it, and click Create.
5. Configure Single Sign-On by following the instructions below.
   • Note: For reference, Microsoft has an older, less up-to-date article regarding this process, here: Tutorial: Azure AD SSO integration with 8x8.

Azure SSO Configuration

1. In the Azure Active Directory admin center > Enterprise applications, click on 8x8 and click Single sign-on.
2. Click SAML.

3. In Basic SAML Configuration, click Edit.

In Basic SAML Configuration, perform the following steps:

4. In Identifier (Entity ID), click Add identifier.
5. Add the following URL into the blank field. This entry should be marked as Default, and there should be no other Identifier entries.
   • https://sso.8x8.com/saml2

6. In the Reply URL box, click Add reply URL.
7. Enter the same URL as for the Identifier. This entry should be marked as Default, and there is no need to modify the Index field.
   • https://sso.8x8.com/saml2

8. Click Save.

Your Basic SAML Configuration should appear as in the screenshot below:

7. Next, in SAML Signing Certificate > Certificate (Base64) click Download, and save the 8x8.cer certificate file onto your computer. You'll apply the certificate later, when configuring Single Sign-On in the 8x8 Admin Console.
   • Critical: Use only the Base64 certificate for configuring Single Sign-On Integration in the 8x8 Admin Console. User single sign-on will fail if you apply other available certificate types.

8. In Set up 8x8, click on Configuration URLs to expand the section (as needed).
9. Individually click the Copy to clipboard icon  for each of the URLs you will use, and paste them into a text editor. You'll need these URLs later, when configuring Single Sign-On Integration in the 8x8 Admin Console.
   • Login URL
   • Azure AD Identifier
   • Logout URL

Important: The Logout URL is optional for 8x8 SSO. If it is applied in 8x8 Admin Console, users logging out of 8x8 services will also be logged out of all Microsoft services. Important: If users or administrators receive a Microsoft error code AADSTS750054 during logout of any 8x8 application, replace the default tenant-specific Azure Logout URL in the Sign-out page URL field of your 8x8 Admin Console Configuration with the following URL: https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0

Assigning Azure AD Users

1. In the Azure portal, select Enterprise applications, and then select All applications.
2. In the applications list, click 8x8.

3. In Manage, click Users and groups.
4. Click Add user/group.

5. Click None Selected to open the Users and groups selection dialogue.
6. Click on the users and/or groups you wish to log into 8x8 services using SSO.
7. Click Select and then Assign to complete the assignment of the 8x8 app to users/groups.

8x8 Admin Console Configuration

1. First, log in to the 8x8 Admin Console.
2. From the Home page, click Identity and Security.

3. In Single Sign-On Integration (SSO), click the slider to enable  SSO integration.
4. Select Microsoft Azure AD.

5. Now you'll apply the URLs and signing certificate that you previously obtained from the 8x8 app in Azure:
   1. Copy and paste the Azure Login URL to the 8x8 Sign-in page URL field.
   2. Copy and paste the Azure Azure AD Identifier to the 8x8 IDP Issuer URL/URN field.
   3. (Optional) Copy and paste the Azure Logout URL to the 8x8 Sign-out page URL field.
   4. In Certificate in use, click on Click to attach and select the Base64 certificate file that you previously downloaded from Azure.
   5. Click Save to apply your 8x8 SSO configuration.

Important: If users or administrators receive a Microsoft error code AADSTS750054 during logout of any 8x8 application, replace the default tenant-specific Azure Logout URL in the Sign-out page URL section with the following URL: https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0

8x8 Admin Console

1. First, log in to the 8x8 Admin Console.
2. From the Home page, click Identity and Security.

3. In User Provisioning Integration (SCIM), click the slider to enable  SCIM integration.
4. Select Microsoft Azure AD.
5. In the Microsoft Azure AD User Provisioning section, click the Copy button  for each of the following sections and paste the copied information into a text editor. You'll apply this information in Azure to enable provisioning of users to 8x8:
   • 8x8 URL
   • 8x8 API Token

6. Click Advanced settings to expand that section.
7. Click the drop-down menu and select the appropriate user retrieval option:
   • All users
     • Retrieves users created in and synced from Azure and users created directly in 8x8 Admin Console, thereby allowing Azure to take control of 8x8 user profiles if the login IDs in both locations are identical.
   • Only users created by the identity provider
     • Limits user retrieval to only those users created in and synced from Azure.

8. Click Save to complete your changes in the 8x8 Admin Console.

Azure Active Directory

1. Return to the Azure Active Directory admin center.
2. Navigate to the Provisioning blade of your installed 8x8 app.

3. Click Get started.

4. Change the Provisioning Mode to Automatic.
5. Paste the 8x8 URL value you copied from 8x8 Admin Console in the previous section into the Tenant URL field.
6. Paste the 8x8 API Token value you copied from 8x8 Admin Console in the previous section into the Secret Token field.

6. Click Test Connection. You should receive a success confirmation message.
7. Click Save to complete this configuration.

User Provisioning Configuration Options