Skip to main content

Check out Interactive Visual Stories to gain hands-on experience with the SSE product features. Click here.

Skyhigh Security

Integrate Azure Active Directory with IAM Enabled Skyhigh CASB

  1. Last updated
  2. Save as PDF

To integrate Azure Active Directory (AD) with IAM enabled Skyhigh CASB, you must add Skyhigh CASB from the Azure Gallery, configure SAML SSO in Skyhigh CASB, then reconfigure Azure AD SSO.

Prerequisites

Before you configure, make sure you have the following prerequisites:

  • An Azure AD account with Azure AD Premium Subscription. Activate the subscription from the Azure free account.
  • Access to Skyhigh CASB tenant with the provisioned user.

Step 1: Add Skyhigh CASB from the Gallery

To add Skyhigh CASB  from the gallery, perform the following activities:

  1. Log in to the Azure portal. 
  2. On the left pane, click the Azure Active Directory icon.
    clipboard_e53b81f918840534ed641ed4800b86eb1.png
  3. Go to Enterprise applications and then select All applications.
    clipboard_e459150441370d2c7b65aa74a7ad7a2e5.png
  4. To add a new application, click New application.
    clipboard_e8b9396ecc5bde79156a72752f690acf4.png
  5. In the search box, enter Skyhigh CASB and select Skyhigh CASB Azure AD SSO Configuration from the result pane. To add the application, click Add.
    clipboard_ef406307407673c52bb0a07de089ec98f.png
     
  6. Click the Skyhigh CASB Azure AD SSO Configuration application. Click Set up single sign on.
    clipboard_e7112b6f413ce07e86c1ac406cd13bd5f.png
     
  7. Edit the Basic SAML Configuration and configure it with default values.
    clipboard_e0a02ea1d07faacb33a159a498e6c1f7f.png

NOTE: The default generated values for the Azure AD SSO URL, Identifier, and Certificates are used in Skyhigh CASB SAML Configuration.

  1. Download the Certificate (Base64) and save the Login URL, Azure AD Identifier to use it in Skyhigh CASB.
    clipboard_ecbbc895e71ec84c3dbf78cae3ab1720b.png
     
  2. Do not close the session, as you need to reconfigure this page after the Skyhigh CASB configuration is completed.

Step 2: Configure SAML SSO in Skyhigh CASB

  1. Login to Skyhigh CASB .
  2. Go to Settings > User Management > SAML Configuration.
  3. Enter these details copied from Azure AD:
    • Azure AD Issuer. Enter the copied URL.
    • Login URL. Enter the App Federation Metadata Url copied from Azure AD.
    • Upload the Azure AD certificate.
      clipboard_e13bb75961ac69bcd01882ac122d62844.png
  4. Click Save.
    Once the configuration is saved in Skyhigh CASB, the Audience and Assertion Consumer Service URL is displayed under Service Provider.

Step 3: Reconfigure Skyhigh CASB Azure AD SSO

  1. Go to the Azure AD Configuration and edit Basic SAML Configuration.
  2. Update Identifier and Reply URL (Assertion Consumer Service URL) and click Save.
    clipboard_eff8473ca56e686f902f873c5537d6039.png
     

Assign the Application to Users 

  1. Click Users and groups.
  2. Click Add User.
    clipboard_e38ac4b020b0efc47f55a67201d83dcc9.png
  3. Search the required users to provide access to Skyhigh CASB and select the Users and assign the application.
    clipboard_e5dce98d2f0951882f3517110339d49dd.png

Step 4: Validate the Azure AD SSO

IDP Initiated Login

  1. Log In to https://myapps.microsoft.com/ with the user assigned Skyhigh CASB application.
  2. Click Skyhigh CASB application.
    You are successfully login to IAM enabled Skyhigh CASB tenant.

Common Errors and Troubleshooting Steps

Azure SSO Errors

Misconfigured identity Provider. Check your configuration and try again. This error occurs when you have User Attributes & Claims using the Namespace URL format.
clipboard_eb725d4204ce44d7053ad6e15d987986c.png

Troubleshooting

In order to verify and resolve the above error, perform the following activities.

  1. Go to Skyhigh CASB application created in Azure AD.
  2. Under User Attributes & Claims, edit and make sure that the below claims are configured accordingly:
    • firstName = user.givenname
    • lastName = usere.surname
    • email = user.userprincipalname
      clipboard_e6b6abe197bc243d95368e4babbffbfa5.png
  3. Under Additional claims, if you see URLs for Claim name, then those URLs need to be removed.
    clipboard_ea4a5366b4b117084e0db96c1cbb6ad9e.png
  4. Edit the respective Claim name and remove the URL from the Namespace and leave it blank.
    clipboard_ede56bfe87bd90d25b813a9298b4e177b.png
  5. After removing the Claim name URLs, the attributes are displayed as shown below and this resolves your error.
    clipboard_e22e10e772e8f70e974c04a7e6c48de35.png
  1. Back to top
  • Was this article helpful?

Recommended articles

  1. Article type
    Topic
  2. Tags
    This page has no tags.