Skip to main content
Azure AD: Using the 8x8 Azure AD App
8x8 Support

Azure AD: Using the 8x8 Azure AD App

Objective

How to use the 8x8 Azure App

Applies To

  • Configuration Manager
  • Microsoft Azure Active Directory (Azure AD)
  • SSO

To install the app, please follow the guide 8x8 app installation and configuration

If you want to configure Single-Sign-On for Azure AD users then please follow the guide Configure Azure Active Directory (Azure AD) for User Single Sign-On (SSO)

Procedure

In the following sections, user attributes are described in bold to indicate the name shown in the Azure AD portal and in italics to indicate the equivalent name seen in PowerShell, Attribute mappings, and the Graph API. For example the surname attribute is labeled Last name in the Azure AD portal.

Create a user

To create a user in 8x8 assign them to the 8x8 App. They appear in Configuration Manager when the next Azure AD sync cycle runs.

8x8 recommends that each AD user to be assigned to 8x8 has their Office (physicalDeliveryOfficeName) attribute set to the name of the 8x8 Site they belong to. You can copy the site name from Configuration Manager.
Azure AD provisioning activity typically runs on a 40 minute cycle. Please allow one hour between assigning a user to the 8x8 app before the user appears in Configuration Manager.

Any unlicensed 8x8 users are visible along with their contact number to the licensed users in their corporate directory. If you do not intend to assign an 8x8 license to the created user then no further action is required.

To configure a user with an X Series service you must sign into Configuration Manager and assign an X Series license to the user. Then edit the user individually , or in bulk, using the Edit feature.

User changes

Whenever an Azure AD user that has been assigned to the 8x8 app is updated, Azure AD pushes any changes to 8x8 as required automatically.

Deactivate and activate a user

If a user has their Block sign in (isSoftDeleted) attribute set to Yes in Azure AD, they are deactivated in 8x8 and are no longer able to make or receive phone calls (except Emergency calls). They are also not able to log in to any applications. Existing login sessions expire within half an hour. The user is not deleted and they retain their X Series license and settings.

When you unblock a sign-in for a user in Azure AD it also re-activates that user in 8x8.

User changes

Whenever an Azure AD user that has been assigned to the 8x8 app is updated, Azure AD pushes any changes to 8x8 as required automatically.

Deactivate and activate a user

If a user has their Block sign in (isSoftDeleted) attribute set to Yes in Azure AD, they are deactivated in 8x8 and are no longer able to make or receive phone calls (except Emergency calls). They are also not able to log in to any applications. Existing login sessions expire within half an hour. The user is not deleted and they retain their X Series license and settings.

When you unblock a sign-in for a user in Azure AD it also re-activates that user in 8x8.

Delete a user

Deleting a user in Azure AD is a two-stage process:

  1. Initial deletion is a soft-delete which moves the user to the “Deleted users” blade in Azure AD. This causes the user to be deactivated in 8x8 (This is similar to blocking sign-in from Azure AD).
  2. When a user is fully deleted from Azure AD, nothing further happens to the 8x8 user. If the user had not already been deactivated, then the user is deactivated at this point, but not deleted. It is not possible to delete an 8x8 user via the integration, you need to do this individually in Configuration Manager.

Administration restrictions in 8x8 Configuration Manager

When a user is created in 8x8 via the Azure AD app, 8x8 considers the user to be owned by Azure AD. This activates some administration restrictions in Configuration Manager, specifically preventing any changes to the key user attributes that are mastered in AD:

  • Username
  • First name
  • Last name
  • Email address
  • Deactivation and Activation

These restrictions are there to ensure your 8x8 users do not become out of sync with Azure AD.

Unassign users from the 8x8 app

When a user is unassigned from the 8x8 app in Azure AD, they are deactivated in the 8x8 app but not deleted.

Link an existing 8x8 user to Azure AD

If you create a user in 8x8 Configuration Manager directly, and there is an equivalent user in Azure AD, then assigning the Azure AD user to the 8x8 app in Azure AD is enough to link them providing the following criteria are met:

Their Username in Configuration Manager matches their User name (userPrincipalName) in AD.

Upon initial assignment to the 8x8 app, Azure AD checks if the user’s attributes are in sync and updates the 8x8 user accordingly. At this point, Configuration Manager considers the user to be owned by Azure AD and prevents any changes to those attributes that are mapped from Azure AD. This restriction avoids data inconsistency by enforcing that changes are only made to the master data source of the user.

Disable the integration

If you want to disable the integration temporarily, there is setting for this in the application’s Provisioning blade in Azure AD.

User provisioning configuration

Site 

Each 8x8 user created through the 8x8 Azure AD app must be associated with a Site before they can be assigned an X Series license. To do this, you need to ensure that the Office (physicalDeliveryOfficeName) attribute contains the exact name of one of your Sites from Configuration Manager.

In the default installation, Site is set from the Office (physicalDeliveryOfficeName) attribute in AD, but you can change this in app mappings to suit your AD environment if required.

If your 8x8 installation has only one Site, you can opt to hard-code its name in the 8x8 application's attribute mappings using a “Constant” mapping type. This avoids the need to set the Office (physicalDeliveryOfficeName) attribute for each user.

Note: A user's site cannot be modified once set

Note: If you change the name of any of your Sites in 8x8 Configuration Manager, the synchronization of users is broken until their Office (physicalDeliveryOfficeName) attribute matches in AD

Contact numbers 

 

In the default installation, the AD user’s Office phone (telephoneNumber) and Mobile phone (mobile) attributes are passed to 8x8 as contact numbers and will be displayed to other 8x8 users in the following places:

  • Company directory of Virtual Office Desktop and Mobile
  • Contact Center directory
  • Switchboard Pro directory

Note: Contact numbers are not displayed in the directory of physical desk phones.

 

User provisioning attribute mappings

Default attribute mappings 

This table shows the default set of attribute mappings for user provisioning.

Azure AD Attribute Azure AD Portal Name System for Cross-domain
Identity Management (SCIM) Attribute
8x8 Configuration Manager Name
userPrincipalName User name userName Username
objectID Object ID externalId Not visible in Configuration Manager
mail Not visible in AD portal emails[type eq "work"].value Email
Not([IsSoftDeleted]) Block sign in active User is greyed out
givenName First name name.givenName First Name
surname Last name name.familyName Last Name
jobTitle Job title title Job title
department Department urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department Department
mobile Mobile phone phoneNumbers[type eq "mobile"].value Personal contact number
telephoneNumber Office phone phoneNumbers[type eq "work"].value Not visible in Configuration Manager
physicalDeliveryOfficeName Office urn:8x8:scim:schemas:extension:8x8user:2.0:User:site Site

Advanced attribute mappings 

This table displays additional attributes that are available but not mapped by default. Instructions for configuration of advanced mappings is outside the scope of this guide.

System for Cross-domain
Identity Management (SCIM) Attribute
Suggested Azure AD attribute Notes
locale PreferredLanguage PreferredLanguage may be set through the AzureAD powershell module
timezone User extension attribute