Azure AD: Using the 8x8 Azure AD App
Objective
How to use the 8x8 Azure App
Applies To
- 8x8 Admin Console
- Microsoft Azure Active Directory (Azure AD)
- SSO
To install the app, please follow the guide 8x8 app installation and configuration
If you want to configure Single-Sign-On for Azure AD users then please follow the guide Configure Azure Active Directory (Azure AD) for User Single Sign-On (SSO)
Procedure
In the following sections, user attributes are described in bold to indicate the name shown in the Azure AD portal and in italics to indicate the equivalent name seen in PowerShell, Attribute mappings, and the Graph API. For example the surname attribute is labeled Last name in the Azure AD portal.
Create a user
To create a user in 8x8 assign them to the 8x8 App. They appear in Admin Console when the next Azure AD sync cycle runs.
8x8 recommends that each AD user to be assigned to 8x8 has their Office (physicalDeliveryOfficeName) attribute set to the name of the 8x8 Site they belong to. You can copy the site name from Admin Console.
Azure AD provisioning activity typically runs on a 40 minute cycle. Please allow one hour between assigning a user to the 8x8 app before the user appears in Admin Console.
Any unlicensed 8x8 users are visible along with their contact number to the licensed users in their corporate directory. If you do not intend to assign an 8x8 license to the created user then no further action is required.
To configure a user with an X Series service you must sign into Admin Console and assign an X Series license to the user. Then edit the user individually , or in bulk, using the Edit feature.
User changes
Whenever an Azure AD user that has been assigned to the 8x8 app is updated, Azure AD pushes any changes to 8x8 as required automatically.
Deactivate and activate a user
If a user has their Block sign in (isSoftDeleted) attribute set to Yes in Azure AD, they are deactivated in 8x8 and are no longer able to make or receive phone calls (except Emergency calls). They are also not able to log in to any applications. Existing login sessions expire within half an hour. The user is not deleted and they retain their X Series license and settings.
When you unblock a sign-in for a user in Azure AD it also re-activates that user in 8x8.
User changes
Whenever an Azure AD user that has been assigned to the 8x8 app is updated, Azure AD pushes any changes to 8x8 as required automatically.
Deactivate and activate a user
If a user has their Block sign in (isSoftDeleted) attribute set to Yes in Azure AD, they are deactivated in 8x8 and are no longer able to make or receive phone calls (except Emergency calls). They are also not able to log in to any applications. Existing login sessions expire within half an hour. The user is not deleted and they retain their X Series license and settings.
When you unblock a sign-in for a user in Azure AD it also re-activates that user in 8x8.
Delete a user
Deleting a user in Azure AD is a two-stage process:
- Initial deletion is a soft-delete which moves the user to the “Deleted users” blade in Azure AD. This causes the user to be deactivated in 8x8 (This is similar to blocking sign-in from Azure AD).
- When a user is fully deleted from Azure AD, nothing further happens to the 8x8 user. If the user had not already been deactivated, then the user is deactivated at this point, but not deleted. It is not possible to delete an 8x8 user via the integration, you need to do this individually in Admin Console .
Administration restrictions in 8x8 Admin Console
When a user is created in 8x8 via the Azure AD app, 8x8 considers the user to be owned by Azure AD. This activates some administration restrictions in Admin Console , specifically preventing any changes to the key user attributes that are mastered in AD:
- Username
- First name
- Last name
- Email address
- Deactivation and Activation
These restrictions are there to ensure your 8x8 users do not become out of sync with Azure AD.
Unassign users from the 8x8 app
When a user is unassigned from the 8x8 app in Azure AD, they are deactivated in the 8x8 app but not deleted.
Link an existing 8x8 user to Azure AD
If you create a user in 8x8 Admin Console directly, and there is an equivalent user in Azure AD, then assigning the Azure AD user to the 8x8 app in Azure AD is enough to link them providing the following criteria are met:
Their Username in Admin Console matches their User name (userPrincipalName) in AD.
Upon initial assignment to the 8x8 app, Azure AD checks if the user’s attributes are in sync and updates the 8x8 user accordingly. At this point, Admin Console considers the user to be owned by Azure AD and prevents any changes to those attributes that are mapped from Azure AD. This restriction avoids data inconsistency by enforcing that changes are only made to the master data source of the user.
Disable the integration
If you want to disable the integration temporarily, there is setting for this in the application’s Provisioning blade in Azure AD.
User provisioning configuration
Site
Each 8x8 user created through the 8x8 Azure AD app must be associated with a Site before they can be assigned an X Series license. To do this, you need to ensure that the Office (physicalDeliveryOfficeName) attribute contains the exact name of one of your Sites from Admin Console .
In the default installation, Site is set from the Office (physicalDeliveryOfficeName) attribute in AD, but you can change this in app mappings to suit your AD environment if required.
If your 8x8 installation has only one Site, you can opt to hard-code its name in the 8x8 application's attribute mappings using a “Constant” mapping type. This avoids the need to set the Office (physicalDeliveryOfficeName) attribute for each user.
Note: A user's site cannot be modified once set
Note: If you change the name of any of your Sites in 8x8 Admin Console, the synchronization of users is broken until their Office (physicalDeliveryOfficeName) attribute matches in AD
Contact numbers
In the default installation, the AD user’s Office phone (telephoneNumber) and Mobile phone (mobile) attributes are passed to 8x8 as contact numbers and will be displayed to other 8x8 users in the following places:
- Company directory of 8x8 Work Desktop and Mobile
- Contact Center directory
- Switchboard Pro directory
Note: Contact numbers are not displayed in the directory of physical desk phones.
User provisioning attribute mappings
Default attribute mappings
This table shows the default set of attribute mappings for user provisioning.
| Azure AD Attribute | Azure AD Portal Name | System for Cross-domain Identity Management (SCIM) Attribute |
8x8 Admin Console Name |
|---|---|---|---|
| userPrincipalName | User name | userName | Username |
| objectID | Object ID | externalId | Not visible in Admin Console |
| Not visible in AD portal | emails[type eq "work"].value | ||
| Not([IsSoftDeleted]) | Block sign in | active | User is greyed out |
| givenName | First name | name.givenName | First Name |
| surname | Last name | name.familyName | Last Name |
| jobTitle | Job title | title | Job title |
| department | Department | urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department | Department |
| mobile | Mobile phone | phoneNumbers[type eq "mobile"].value | Personal contact number |
| telephoneNumber | Office phone | phoneNumbers[type eq "work"].value | Not visible in Admin Console |
| physicalDeliveryOfficeName | Office | urn:8x8:scim:schemas:extension:8x8user:2.0:User:site | Site |
Advanced attribute mappings
This table displays additional attributes that are available but not mapped by default. Instructions for configuration of advanced mappings is outside the scope of this guide.
| System for Cross-domain Identity Management (SCIM) Attribute |
Suggested Azure AD attribute | Notes |
|---|---|---|
| locale | PreferredLanguage | PreferredLanguage may be set through the AzureAD powershell module |
| timezone | User extension attribute |